Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the golang group across 1 directory with 15 updates #814

Closed
wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 5, 2024

Bumps the golang group with 4 updates in the / directory: github.com/cert-manager/cert-manager, sigs.k8s.io/controller-runtime, github.com/prometheus/common and sigs.k8s.io/gateway-api.

Updates github.com/cert-manager/cert-manager from 1.12.14 to 1.16.2

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.16.2

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release of cert-manager 1.16 makes several changes to how PEM input is validated, adding maximum sizes appropriate to the type of PEM data which is being parsed.

This is to prevent an unacceptable slow-down in parsing specially crafted PEM data. The issue was found by Google's OSS-Fuzz project.

The issue is low severity; to exploit the PEM issue would require privileged access which would likely allow Denial-of-Service through other methods.

Note also that since most PEM data parsed by cert-manager comes from ConfigMap or Secret resources which have a max size limit of approximately 1MB, it's difficult to force cert-manager to parse large amounts of PEM data.

Further information is available in GHSA-r4pg-vg54-wxx4

In addition, the version of Go used to build cert-manager 1.16 was updated along with the base images.

Changes by Kind

Bug or Regression

  • Set a maximum size for PEM inputs which cert-manager will accept to remove possibility of taking a long time to process an input (#7401, @​SgtCoDFish)

Other (Cleanup or Flake)

v1.16.1

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

The cert-manager 1.16 release includes: new Helm chart features, more Prometheus metrics, memory optimizations, and various improvements and bug fixes for the ACME issuer and Venafi Issuer.

📖 Read the complete 1.16 release notes before upgrading.

📜Changes since v1.16.0

Bug or Regression

  • BUGFIX: Helm schema validation: the new schema validation was too strict for the "global" section. Since the global section is shared across all charts and sub-charts, we must also allow unknown fields. (#7348, @inteon)
  • BUGFIX: Helm will now accept percentages for the podDisruptionBudget.minAvailable and podDisruptionBudget.maxAvailable values. (#7345, @inteon)
  • Helm: allow enabled to be set as a value to toggle cert-manager as a dependency. (#7356, @inteon)
  • BUGFIX: A change in v1.16.0 caused cert-manager's ACME ClusterIssuer to look in the wrong namespace for resources required for the issuance (e.g. credential Secrets). This is now fixed in v1.16.1. (#7342, @inteon)

v1.16.0

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

The cert-manager 1.16 release includes: new Helm chart features, more Prometheus metrics, memory optimizations, and various improvements and bug fixes for the ACME issuer and Venafi Issuer.

📖 Read the complete 1.16 release notes at cert-manager.io.

⚠️ Known issues

  1. Helm Chart: JSON schema prevents the chart being used as a sub-chart on Rancher RKE.

... (truncated)

Commits
  • 33df0f2 Merge pull request #7431 from SgtCoDFish/release-1.16-bumps
  • 03f9832 [release-1.16] bump go + base images
  • 5001e8b Merge pull request #7401 from SgtCoDFish/release-1.16-pem-inputs
  • 3ba1f2c [release-1.16] bump base images
  • d99dddb security: remove calls to pem.Decode in non-test code
  • 481b67b security: Add functions to limit max PEM sizes allowable
  • 24f59c3 Merge pull request #7370 from SgtCoDFish/release-1.16-ipv6-dns
  • a9785d4 [release-1.16] add IPv6 example for recursive DNS arg
  • ff50c06 Merge pull request #7356 from cert-manager-bot/cherry-pick-7350-to-release-1.16
  • 2298278 Helm: add enabled to json schema
  • Additional commits viewable in compare view

Updates sigs.k8s.io/controller-runtime from 0.19.2 to 0.19.3

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.19.3

What's Changed

Full Changelog: kubernetes-sigs/controller-runtime@v0.19.2...v0.19.3

Commits
  • 3e66810 Merge pull request #3037 from kubernetes-sigs/backport019-watch
  • 2085acc add watch deprecated to certwatcher
  • 0823530 Merge pull request #3031 from k8s-infra-cherrypick-robot/cherry-pick-3028-to-...
  • e727239 [release-0.19] 🐛 Refactor certificate watcher to use polling, instead of fsno...
  • 2a0ce59 🌱 Make using leader elector with client timeout non-breaking
  • 4bc3811 🐛 Fix RenewDeadline typo in leader election
  • 0170742 warning: Use leader elector with client timeout
  • See full diff in compare view

Updates github.com/prometheus/client_golang from 1.19.1 to 1.20.4

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.20.4

  • [BUGFIX] histograms: Fix a possible data race when appending exemplars vs metrics gather. #1623

v1.20.3

  • [BUGFIX] histograms: Fix possible data race when appending exemplars. #1608

v1.20.2

  • [BUGFIX] promhttp: Unset Content-Encoding header when data is uncompressed. #1596

v1.20.1

This release contains the critical fix for the issue. Thanks to @​geberl, @​CubicrootXYZ, @​zetaab and @​timofurrer for helping us with the investigation!

  • [BUGFIX] process-collector: Fixed unregistered descriptor error when using process collector with PedanticRegistry on Linux machines. #1587

v1.20.0

Thanks everyone for contributions!

⚠️ In this release we remove one (broken anyway, given Go runtime changes) metric and add three new (representing GOGC, GOMEMLIMIT and GOMAXPROCS flags) to the default collectors.NewGoCollector() collector. Given its popular usage, expect your binary to expose two additional metric.

Changes

  • [CHANGE] ⚠️ go-collector: Remove go_memstat_lookups_total metric which was always 0; Go runtime stopped sharing pointer lookup statistics. #1577
  • [FEATURE] ⚠️ go-collector: Add 3 default metrics: go_gc_gogc_percent, go_gc_gomemlimit_bytes and go_sched_gomaxprocs_threads as those are recommended by the Go team. #1559
  • [FEATURE] go-collector: Add more information to all metrics' HELP e.g. the exact runtime/metrics sourcing each metric (if relevant). #1568 #1578
  • [FEATURE] testutil: Add CollectAndFormat method. #1503
  • [FEATURE] histograms: Add support for exemplars in native histograms. #1471
  • [FEATURE] promhttp: Add experimental support for zstd on scrape, controlled by the request Accept-Encoding header. #1496
  • [FEATURE] api/v1: Add WithLimit parameter to all API methods that supports it. #1544
  • [FEATURE] prometheus: Add support for created timestamps in constant histograms and constant summaries. #1537
  • [FEATURE] process-collectors: Add network usage metrics: process_network_receive_bytes_total and process_network_transmit_bytes_total. #1555
  • [FEATURE] promlint: Add duplicated metric lint rule. #1472
  • [BUGFIX] promlint: Relax metric type in name linter rule. #1455
  • [BUGFIX] promhttp: Make sure server instrumentation wrapping supports new and future extra responseWriter methods. #1480
  • [BUGFIX] testutil: Functions using compareMetricFamilies are now failing if filtered metricNames are not in the input. #1424

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.20.4 / 2024-09-07

  • [BUGFIX] histograms: Fix possible data race when appending exemplars vs metrics gather. #1623

1.20.3 / 2024-09-05

  • [BUGFIX] histograms: Fix possible data race when appending exemplars. #1608

1.20.2 / 2024-08-23

  • [BUGFIX] promhttp: Unset Content-Encoding header when data is uncompressed. #1596

1.20.1 / 2024-08-20

  • [BUGFIX] process-collector: Fixed unregistered descriptor error when using process collector with PedanticRegistry on linux machines. #1587

1.20.0 / 2024-08-14

  • [CHANGE] ⚠️ go-collector: Remove go_memstat_lookups_total metric which was always 0; Go runtime stopped sharing pointer lookup statistics. #1577
  • [FEATURE] ⚠️ go-collector: Add 3 default metrics: go_gc_gogc_percent, go_gc_gomemlimit_bytes and go_sched_gomaxprocs_threads as those are recommended by the Go team. #1559
  • [FEATURE] go-collector: Add more information to all metrics' HELP e.g. the exact runtime/metrics sourcing each metric (if relevant). #1568 #1578
  • [FEATURE] testutil: Add CollectAndFormat method. #1503
  • [FEATURE] histograms: Add support for exemplars in native histograms. #1471
  • [FEATURE] promhttp: Add experimental support for zstd on scrape, controlled by the request Accept-Encoding header. #1496
  • [FEATURE] api/v1: Add WithLimit parameter to all API methods that supports it. #1544
  • [FEATURE] prometheus: Add support for created timestamps in constant histograms and constant summaries. #1537
  • [FEATURE] process-collector: Add network usage metrics: process_network_receive_bytes_total and process_network_transmit_bytes_total. #1555
  • [FEATURE] promlint: Add duplicated metric lint rule. #1472
  • [BUGFIX] promlint: Relax metric type in name linter rule. #1455
  • [BUGFIX] promhttp: Make sure server instrumentation wrapping supports new and future extra responseWriter methods. #1480
  • [BUGFIX] breaking testutil: Functions using compareMetricFamilies are now failing if filtered metricNames are not in the input. #1424 (reverted in 1.20.5)

1.19.0 / 2024-02-27

The module prometheus/common v0.48.0 introduced an incompatibility when used together with client_golang (See prometheus/client_golang#1448 for more details). If your project uses client_golang and you want to use prometheus/common v0.48.0 or higher, please update client_golang to v1.19.0.

  • [CHANGE] Minimum required go version is now 1.20 (we also test client_golang against new 1.22 version). #1445 #1449
  • [FEATURE] collectors: Add version collector. #1422 #1427

1.18.0 / 2023-12-22

  • [FEATURE] promlint: Allow creation of custom metric validations. #1311
  • [FEATURE] Go programs using client_golang can be built in wasip1 OS. #1350
  • [BUGFIX] histograms: Add timer to reset ASAP after bucket limiting has happened. #1367
  • [BUGFIX] testutil: Fix comparison of metrics with empty Help strings. #1378
  • [ENHANCEMENT] Improved performance of MetricVec.WithLabelValues(...). #1360

1.17.0 / 2023-09-27

  • [CHANGE] Minimum required go version is now 1.19 (we also test client_golang against new 1.21 version). #1325

... (truncated)

Commits
  • 05fcde9 Merge pull request #1623 from krajorama/data-race-in-histogram-write
  • 209f4c0 Add changelog
  • 1e398cc native histogram: Fix race between Write and addExemplar
  • ef2f87e Merge pull request #1620 from prometheus/arthursens/prepare-1.20.3
  • 937ac63 Add changelog entry for 1.20.3
  • 6e9914d Merge pull request #1608 from krajorama/index-out-of-range-native-histogram-e...
  • d6b8c89 Update comments with more explanations
  • 504566f Use simplified solution from #1609 for the data race
  • dc8e9a4 fix: native histogram: Simplify and fix addExemplar
  • dc819ce Use a trivial solution to #1605
  • Additional commits viewable in compare view

Updates github.com/prometheus/common from 0.55.0 to 0.61.0

Release notes

Sourced from github.com/prometheus/common's releases.

v0.61.0

What's Changed

Full Changelog: prometheus/common@v0.60.1...v0.61.0

v0.60.1

What's Changed

Full Changelog: prometheus/common@v0.60.0...v0.60.1

v0.60.0

What's Changed

Full Changelog: prometheus/common@v0.59.1...v0.60.0

... (truncated)

Commits
  • 7b484e9 Bump google.golang.org/protobuf from 1.35.1 to 1.35.2 (#732)
  • 05e3c40 Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#731)
  • a0ef737 Bump golang.org/x/net from 0.30.0 to 0.32.0 (#736)
  • f99f029 Update common Prometheus files (#726)
  • b88f24c promslog: always lowercase log level from CLI (#728)
  • 2c3c048 Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0 (#730)
  • ec7291f Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 in /assets (#729)
  • 145b50a fix(promslog): always use UTC for time (#735)
  • 39a62f7 fix: values escaping bugs (#727)
  • 7ed4523 Allow custom user-agent definition (#725)
  • Additional commits viewable in compare view

Updates golang.org/x/exp from 0.0.0-20240416160154-fe59bbe5cc7f to 0.0.0-20240719175910-8a7402abbf56

Commits

Updates golang.org/x/net from 0.31.0 to 0.32.0

Commits
  • 285e1cf go.mod: update golang.org/x dependencies
  • d0a1049 route: remove unused sizeof* consts on freebsd
  • 6e41410 http2: fix benchmarks using common frame read/write functions
  • 4be1253 route: change from syscall to x/sys/unix
  • bc37675 http2: limit number of PINGs bundled with RST_STREAMs
  • e9cd716 route: fix parse of zero-length sockaddrs in RIBs
  • 9a51899 http2: add SETTINGS_ENABLE_CONNECT_PROTOCOL support
  • See full diff in compare view

Updates golang.org/x/oauth2 from 0.21.0 to 0.24.0

Commits
  • 22134a4 README: don't recommend go get
  • 3e64809 x/oauth2: add Token.ExpiresIn
  • 16a9973 jwt: rename example to avoid vet error
  • b52af7d endpoints: add GitLab DeviceAuthURL
  • 6d8340f LICENSE: update per Google Legal
  • See full diff in compare view

Updates golang.org/x/sys from 0.27.0 to 0.28.0

Commits
  • fe16172 unix: define IfMsghdr2, IfData64, and RtMsghdr2 on darwin
  • 0a57dbc unix: update to kernel Linux 6.12
  • 3cf1e67 unix: don't fail TestPpoll on EINTR
  • d2cea70 windows: add functions to get named pipe process IDs
  • a13946c windows: regenerate zsyscall_windows.go
  • See full diff in compare view

Updates golang.org/x/term from 0.26.0 to 0.27.0

Commits

Updates golang.org/x/text from 0.20.0 to 0.21.0

Commits

Updates golang.org/x/time from 0.5.0 to 0.6.0

Commits

Updates google.golang.org/protobuf from 1.35.1 to 1.35.2

Updates k8s.io/kube-openapi from 0.0.0-20240423202451-8948a665c108 to 0.0.0-20240903163716-9e1beecbcb38

Commits

Updates k8s.io/utils from 0.0.0-20240711033017-18e509b52bc8 to 0.0.0-20240921022957-49e7df575cb6

Commits

Updates sigs.k8s.io/gateway-api from 1.2.0 to 1.2.1

Release notes

Sourced from sigs.k8s.io/gateway-api's releases.

v1.2.1

This is a patch release that fixes the backward incompatibility with the SupportedFeatures feature breaking change introduced in v1.2.0.

Bug Fixes

  • v1.2.0 introduced a breaking change in the SupportedFeatures field of the GatewayClass API. That broke already existing GatewayClasses using the previous version of the feature. The fix to introduce backward compatibility is in (#3454, @​LiorLieberman).
Commits
  • a8fe5c8 chore: CHANGELOG for 1.2.1 (#3480)
  • 3725727 chore: bump bundle version to 1.2.1 (#3478)
  • 20b8e4e [release-1.2] override unmarshalJSON for supportedfeature to ensure comptabil...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot force-pushed the dependabot/go_modules/golang-991a58b6b0 branch 2 times, most recently from 6947ebf to c252b60 Compare December 9, 2024 18:20
Bumps the golang group with 4 updates in the / directory: [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager), [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime), [github.com/prometheus/common](https://github.com/prometheus/common) and [sigs.k8s.io/gateway-api](https://github.com/kubernetes-sigs/gateway-api).


Updates `github.com/cert-manager/cert-manager` from 1.12.14 to 1.16.2
- [Release notes](https://github.com/cert-manager/cert-manager/releases)
- [Changelog](https://github.com/cert-manager/cert-manager/blob/master/RELEASE.md)
- [Commits](cert-manager/cert-manager@v1.12.14...v1.16.2)

Updates `sigs.k8s.io/controller-runtime` from 0.19.2 to 0.19.3
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.19.2...v0.19.3)

Updates `github.com/prometheus/client_golang` from 1.19.1 to 1.20.4
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.19.1...v1.20.4)

Updates `github.com/prometheus/common` from 0.55.0 to 0.61.0
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/RELEASE.md)
- [Commits](prometheus/common@v0.55.0...v0.61.0)

Updates `golang.org/x/exp` from 0.0.0-20240416160154-fe59bbe5cc7f to 0.0.0-20240719175910-8a7402abbf56
- [Commits](https://github.com/golang/exp/commits)

Updates `golang.org/x/net` from 0.31.0 to 0.32.0
- [Commits](golang/net@v0.31.0...v0.32.0)

Updates `golang.org/x/oauth2` from 0.21.0 to 0.24.0
- [Commits](golang/oauth2@v0.21.0...v0.24.0)

Updates `golang.org/x/sys` from 0.27.0 to 0.28.0
- [Commits](golang/sys@v0.27.0...v0.28.0)

Updates `golang.org/x/term` from 0.26.0 to 0.27.0
- [Commits](golang/term@v0.26.0...v0.27.0)

Updates `golang.org/x/text` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.20.0...v0.21.0)

Updates `golang.org/x/time` from 0.5.0 to 0.6.0
- [Commits](golang/time@v0.5.0...v0.6.0)

Updates `google.golang.org/protobuf` from 1.35.1 to 1.35.2

Updates `k8s.io/kube-openapi` from 0.0.0-20240423202451-8948a665c108 to 0.0.0-20240903163716-9e1beecbcb38
- [Commits](https://github.com/kubernetes/kube-openapi/commits)

Updates `k8s.io/utils` from 0.0.0-20240711033017-18e509b52bc8 to 0.0.0-20240921022957-49e7df575cb6
- [Commits](https://github.com/kubernetes/utils/commits)

Updates `sigs.k8s.io/gateway-api` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/kubernetes-sigs/gateway-api/releases)
- [Changelog](https://github.com/kubernetes-sigs/gateway-api/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/gateway-api@v1.2.0...v1.2.1)

---
updated-dependencies:
- dependency-name: github.com/cert-manager/cert-manager
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: golang
- dependency-name: github.com/prometheus/client_golang
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: golang
- dependency-name: github.com/prometheus/common
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: golang
- dependency-name: golang.org/x/exp
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: golang
- dependency-name: golang.org/x/net
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: golang
- dependency-name: golang.org/x/oauth2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: golang
- dependency-name: golang.org/x/sys
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: golang
- dependency-name: golang.org/x/term
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: golang
- dependency-name: golang.org/x/text
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: golang
- dependency-name: golang.org/x/time
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: golang
- dependency-name: google.golang.org/protobuf
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: golang
- dependency-name: k8s.io/kube-openapi
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: golang
- dependency-name: k8s.io/utils
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: golang
- dependency-name: sigs.k8s.io/gateway-api
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: golang
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/go_modules/golang-991a58b6b0 branch from c252b60 to 1973d18 Compare December 10, 2024 18:35
Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 11, 2024

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Dec 11, 2024
@dependabot dependabot bot deleted the dependabot/go_modules/golang-991a58b6b0 branch December 11, 2024 18:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants