Skip to content

build(deps): bump the dependencies group across 1 directory with 14 updates#300

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/dependencies-48e5100da9
Open

build(deps): bump the dependencies group across 1 directory with 14 updates#300
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/dependencies-48e5100da9

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Jan 6, 2025

Bumps the dependencies group with 10 updates in the / directory:

Package From To
github.com/getsentry/sentry-go 0.28.1 0.31.1
github.com/go-ping/ping 1.1.0 1.2.0
github.com/labstack/echo/v4 4.12.0 4.13.3
github.com/prometheus/client_golang 1.20.0 1.20.5
github.com/prometheus/common 0.55.0 0.61.0
github.com/sagernet/sing 0.4.2 0.5.1
github.com/sagernet/sing-box 1.9.4 1.10.6
github.com/urfave/cli/v2 2.27.4 2.27.5
github.com/xtls/xray-core 1.8.23 1.8.24
modernc.org/sqlite 1.32.0 1.34.4

Updates github.com/getsentry/sentry-go from 0.28.1 to 0.31.1

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.31.1

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.31.1.

Bug Fixes

  • Correct wrong module name for sentry-go/logrus (#950)

0.31.0

Breaking Changes

  • Remove support for metrics. Read more about the end of the Metrics beta here. (#914)

  • Remove support for profiling. (#915)

  • Remove Segment field from the User struct. This field is no longer used in the Sentry product. (#928)

  • Every integration is now a separate module, reducing the binary size and number of dependencies. Once you update sentry-go to latest version, you'll need to go get the integration you want to use. For example, if you want to use the echo integration, you'll need to run go get github.com/getsentry/sentry-go/echo (#919).

Features

  • Add the ability to override hub in context for integrations that use custom context. (#931)

  • Add HubProvider Hook for sentrylogrus, enabling dynamic Sentry hub allocation for each log entry or goroutine. (#936)

This change enhances compatibility with Sentry's recommendation of using separate hubs per goroutine. To ensure a separate Sentry hub for each goroutine, configure the HubProvider like this:

hook, err := sentrylogrus.New(nil, sentry.ClientOptions{})
if err != nil {
    log.Fatalf("Failed to initialize Sentry hook: %v", err)
}
// Set a custom HubProvider to generate a new hub for each goroutine or log entry
hook.SetHubProvider(func() *sentry.Hub {
client, _ := sentry.NewClient(sentry.ClientOptions{})
return sentry.NewHub(client, sentry.NewScope())
})
logrus.AddHook(hook)

Bug Fixes

  • Add support for closing worker goroutines started by the HTTPTranport to prevent goroutine leaks. (#894)
client, _ := sentry.NewClient()
defer client.Close()

... (truncated)

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.31.1

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.31.1.

Bug Fixes

  • Correct wrong module name for sentry-go/logrus (#950)

0.31.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.31.0.

Breaking Changes

  • Remove support for metrics. Read more about the end of the Metrics beta here. (#914)

  • Remove support for profiling. (#915)

  • Remove Segment field from the User struct. This field is no longer used in the Sentry product. (#928)

  • Every integration is now a separate module, reducing the binary size and number of dependencies. Once you update sentry-go to latest version, you'll need to go get the integration you want to use. For example, if you want to use the echo integration, you'll need to run go get github.com/getsentry/sentry-go/echo (#919).

Features

Add the ability to override hub in context for integrations that use custom context. (#931)

  • Add HubProvider Hook for sentrylogrus, enabling dynamic Sentry hub allocation for each log entry or goroutine. (#936)

This change enhances compatibility with Sentry's recommendation of using separate hubs per goroutine. To ensure a separate Sentry hub for each goroutine, configure the HubProvider like this:

hook, err := sentrylogrus.New(nil, sentry.ClientOptions{})
if err != nil {
    log.Fatalf("Failed to initialize Sentry hook: %v", err)
}
// Set a custom HubProvider to generate a new hub for each goroutine or log entry
hook.SetHubProvider(func() *sentry.Hub {
client, _ := sentry.NewClient(sentry.ClientOptions{})
return sentry.NewHub(client, sentry.NewScope())
})
logrus.AddHook(hook)

Bug Fixes

  • Add support for closing worker goroutines started by the HTTPTranport to prevent goroutine leaks. (#894)
</tr></table> 

... (truncated)

Commits

Updates github.com/go-ping/ping from 1.1.0 to 1.2.0

Release notes

Sourced from github.com/go-ping/ping's releases.

v1.2.0

What's Changed

New Contributors

Full Changelog: go-ping/ping@v1.1.0...v1.2.0

Commits

Updates github.com/labstack/echo/v4 from 4.12.0 to 4.13.3

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.13.3

Security

Full Changelog: labstack/echo@v4.13.2...v4.13.3

v4.13.2 - update dependencies

Security

Full Changelog: labstack/echo@v4.13.1...v4.13.2

v4.13.1

Fixes

Full Changelog: labstack/echo@v4.13.0...v4.13.1

JWT Middleware Removed

BREAKING CHANGE: JWT Middleware Removed from Core

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository or see alternative implementation

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

Background:

The version of golang-jwt/jwt (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR #1946](labstack/echo#1946). JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.

We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.

Enhancements

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.13.3 - 2024-12-19

Security

v4.13.2 - 2024-12-12

Security

v4.13.1 - 2024-12-11

Fixes

v4.13.0 - 2024-12-04

BREAKING CHANGE JWT Middleware Removed from Core use labstack/echo-jwt instead

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository.

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

Background:

The version of golang-jwt/jwt (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR #1946](labstack/echo#1946). JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.

We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.

Enhancements

... (truncated)

Commits

Updates github.com/prometheus/client_golang from 1.20.0 to 1.20.5

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.20.5 / 2024-10-15

We decided to revert the testutil change that made our util functions less error-prone, but created a lot of work for our downstream users. Apologies for the pain! This revert should not cause any major breaking change, even if you already did the work--unless you depend on the exact error message.

Going forward, we plan to reinforce our release testing strategy [1],[2] and deliver an enhanced testutil package/module with more flexible and safer APIs.

Thanks to @​dashpole @​dgrisonnet @​kakkoyun @​ArthurSens @​vesari @​logicalhan @​krajorama @​bwplotka who helped in this patch release! 🤗

Changelog

[BUGFIX] testutil: Reverted #1424; functions using compareMetricFamilies are (again) only failing if filtered metricNames are in the expected input. #1645

v1.20.4

  • [BUGFIX] histograms: Fix a possible data race when appending exemplars vs metrics gather. #1623

v1.20.3

  • [BUGFIX] histograms: Fix possible data race when appending exemplars. #1608

v1.20.2

  • [BUGFIX] promhttp: Unset Content-Encoding header when data is uncompressed. #1596

v1.20.1

This release contains the critical fix for the issue. Thanks to @​geberl, @​CubicrootXYZ, @​zetaab and @​timofurrer for helping us with the investigation!

  • [BUGFIX] process-collector: Fixed unregistered descriptor error when using process collector with PedanticRegistry on Linux machines. #1587
Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.20.5 / 2024-10-15

  • [BUGFIX] testutil: Reverted #1424; functions using compareMetricFamilies are (again) only failing if filtered metricNames are in the expected input.

1.20.4 / 2024-09-07

  • [BUGFIX] histograms: Fix possible data race when appending exemplars vs metrics gather. #1623

1.20.3 / 2024-09-05

  • [BUGFIX] histograms: Fix possible data race when appending exemplars. #1608

1.20.2 / 2024-08-23

  • [BUGFIX] promhttp: Unset Content-Encoding header when data is uncompressed. #1596

1.20.1 / 2024-08-20

  • [BUGFIX] process-collector: Fixed unregistered descriptor error when using process collector with PedanticRegistry on linux machines. #1587
Commits
  • 48e12a1 Merge pull request #1645 from prometheus/cut-1204-pr1424
  • 504ad9b Cut 1.20.5; update comments.
  • 584a7ce Revert "testutil compareMetricFamilies: make less error-prone (#1424)"
  • 05fcde9 Merge pull request #1623 from krajorama/data-race-in-histogram-write
  • 209f4c0 Add changelog
  • 1e398cc native histogram: Fix race between Write and addExemplar
  • ef2f87e Merge pull request #1620 from prometheus/arthursens/prepare-1.20.3
  • 937ac63 Add changelog entry for 1.20.3
  • 6e9914d Merge pull request #1608 from krajorama/index-out-of-range-native-histogram-e...
  • d6b8c89 Update comments with more explanations
  • Additional commits viewable in compare view

Updates github.com/prometheus/common from 0.55.0 to 0.61.0

Release notes

Sourced from github.com/prometheus/common's releases.

v0.61.0

What's Changed

Full Changelog: prometheus/common@v0.60.1...v0.61.0

v0.60.1

What's Changed

Full Changelog: prometheus/common@v0.60.0...v0.60.1

v0.60.0

What's Changed

Full Changelog: prometheus/common@v0.59.1...v0.60.0

... (truncated)

Commits
  • 7b484e9 Bump google.golang.org/protobuf from 1.35.1 to 1.35.2 (#732)
  • 05e3c40 Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#731)
  • a0ef737 Bump golang.org/x/net from 0.30.0 to 0.32.0 (#736)
  • f99f029 Update common Prometheus files (#726)
  • b88f24c promslog: always lowercase log level from CLI (#728)
  • 2c3c048 Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0 (#730)
  • ec7291f Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 in /assets (#729)
  • 145b50a fix(promslog): always use UTC for time (#735)
  • 39a62f7 fix: values escaping bugs (#727)
  • 7ed4523 Allow custom user-agent definition (#725)
  • Additional commits viewable in compare view

Updates github.com/sagernet/sing from 0.4.2 to 0.5.1

Commits
  • 8c0bf1c Fix clear lru cache
  • ad36d3b http: Fix proxying websocket
  • 72db784 Add bind.Interface.Flags
  • d59ac57 Add go1.21 compat funcs
  • c635464 Add Update() error to control.InterfaceFinder
  • 55908be Update linter configuration
  • 6567829 Fix cached conn eats up read deadlines
  • c324d41 json: Add badoption templates
  • 0acb36c Minor fixes
  • 26511a2 udpnat: Fix read deadline not initialized
  • Additional commits viewable in compare view

Updates github.com/sagernet/sing-box from 1.9.4 to 1.10.6

Release notes

Sourced from github.com/sagernet/sing-box's releases.

1.10.6

📝 Release Notes

  • Fixes and improvements

1.10.5

📝 Release Notes

  • Fixes and improvements

1.10.4

📝 Release Notes

  • Fixes and improvements

1.10.3

📝 Release Notes

  • Fixes and improvements

1.10.2

📝 Release Notes

  • Add deprecated warnings
  • Fix proxying websocket connections in HTTP/mixed inbounds
  • Fixes and improvements

1.10.1

📝 Release Notes

  • Fixes and improvements

1.10.0

📝 Release Notes

Important changes since 1.9:

  • Introducing auto-redirect 1
  • Add AdGuard DNS Filter support 2
  • TUN address fields are merged 3
  • Add custom options for auto-route and auto-redirect 4
  • Drop support for go1.18 and go1.19 5
  • Add tailing comma support in JSON configuration
  • Improve sniffers 6
  • Add new inline rule-set type 7
  • Add access control options for Clash API 8
  • Add rule_set_ip_cidr_accept_empty DNS address filter rule item 9
  • Add auto reload support for local rule-set
  • Update fsnotify usages 10
  • Add IP address support for rule-set match command

... (truncated)

Changelog

Sourced from github.com/sagernet/sing-box's changelog.

1.10.6

  • Fixes and improvements

1.10.2

  • Add deprecated warnings
  • Fix proxying websocket connections in HTTP/mixed inbounds
  • Fixes and improvements

1.10.1

  • Fixes and improvements

1.10.0

Important changes since 1.9:

  • Introducing auto-redirect 1
  • Add AdGuard DNS Filter support 2
  • TUN address fields are merged 3
  • Add custom options for auto-route and auto-redirect 4
  • Drop support for go1.18 and go1.19 5
  • Add tailing comma support in JSON configuration
  • Improve sniffers 6
  • Add new inline rule-set type 7
  • Add access control options for Clash API 8
  • Add rule_set_ip_cidr_accept_empty DNS address filter rule item 9
  • Add auto reload support for local rule-set
  • Update fsnotify usages 10
  • Add IP address support for rule-set match command
  • Add rule-set decompile command
  • Add process_path_regex rule item
  • Update uTLS to v1.6.7 11
  • Optimize memory usages of rule-sets 12

1:

The new auto-redirect feature allows TUN to automatically configure connection redirection to improve proxy performance.

When auto-redirect is enabled, new route address set options will allow you to automatically configure destination IP CIDR rules from a specified rule set to the firewall.

Specified or unspecified destinations will bypass the sing-box routes to get better performance (for example, keep hardware offloading of direct traffics on the router).

See TUN.

2:

... (truncated)

Commits

Updates github.com/stretchr/testify from 1.9.0 to 1.10.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.10.0

What's Changed

Functional Changes

Fixes

Documantation, Build & CI

New Contributors

... (truncated)

Commits
  • 89cbdd9 Merge pull request #1626 from arjun-1/fix-functional-options-diff-indirect-calls
  • 07bac60 Merge pull request #1667 from sikehish/flaky
  • 716de8d Increase timeouts in Test_Mock_Called_blocks to reduce flakiness in CI
  • 118fb83 NotSame should fail if args are not pointers #1661 (#1664)
  • 7d99b2b attempt 2
  • 05f87c0 more similar
  • ea7129e better fmt
  • a1b9c9e Merge pull request #1663 from ybrustin/master
  • 8302de9 Merge branch 'master' into master
  • 89352f7 Merge pull request #1518 from hendrywiranto/adjust-readme-remove-v2
  • Additional commits viewable in compare view

Updates github.com/urfave/cli/v2 from 2.27.4 to 2.27.5

Release notes

Sourced from github.com/urfave/cli/v2's releases.

v2.27.5

What's Changed

Full Changelog: urfave/cli@v2.27.4...v2.27.5

Commits
  • f035ffa Merge pull request #1980 from urfave/v2-update-deps
  • 6b0d484 Adjust test data doc to use current md2man format
  • 6227bb0 Update dependencies to latest
  • bcc6869 Merge pull request #1970 from asahasrabuddhe/backport-issue-1884
  • e3ff573 fix: /bin/zsh env variable to retrieve current active shell
  • 9114559 Merge pull request #1956 from BlackHole1/improve-flags-docs
  • 584e28a Merge branch 'v2-maint' into improve-flags-docs
  • 376a256 Update docs/v2/examples/flags.md
  • 43eafe1 docs(flag): add UseShortOptionHandling description
  • See full diff in

…pdates

Bumps the dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) | `0.28.1` | `0.31.1` |
| [github.com/go-ping/ping](https://github.com/go-ping/ping) | `1.1.0` | `1.2.0` |
| [github.com/labstack/echo/v4](https://github.com/labstack/echo) | `4.12.0` | `4.13.3` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.20.0` | `1.20.5` |
| [github.com/prometheus/common](https://github.com/prometheus/common) | `0.55.0` | `0.61.0` |
| [github.com/sagernet/sing](https://github.com/sagernet/sing) | `0.4.2` | `0.5.1` |
| [github.com/sagernet/sing-box](https://github.com/sagernet/sing-box) | `1.9.4` | `1.10.6` |
| [github.com/urfave/cli/v2](https://github.com/urfave/cli) | `2.27.4` | `2.27.5` |
| [github.com/xtls/xray-core](https://github.com/xtls/xray-core) | `1.8.23` | `1.8.24` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.32.0` | `1.34.4` |



Updates `github.com/getsentry/sentry-go` from 0.28.1 to 0.31.1
- [Release notes](https://github.com/getsentry/sentry-go/releases)
- [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-go@v0.28.1...v0.31.1)

Updates `github.com/go-ping/ping` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/go-ping/ping/releases)
- [Changelog](https://github.com/go-ping/ping/blob/master/.goreleaser.yml)
- [Commits](go-ping/ping@v1.1.0...v1.2.0)

Updates `github.com/labstack/echo/v4` from 4.12.0 to 4.13.3
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v4.12.0...v4.13.3)

Updates `github.com/prometheus/client_golang` from 1.20.0 to 1.20.5
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.20.0...v1.20.5)

Updates `github.com/prometheus/common` from 0.55.0 to 0.61.0
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/RELEASE.md)
- [Commits](prometheus/common@v0.55.0...v0.61.0)

Updates `github.com/sagernet/sing` from 0.4.2 to 0.5.1
- [Commits](SagerNet/sing@v0.4.2...v0.5.1)

Updates `github.com/sagernet/sing-box` from 1.9.4 to 1.10.6
- [Release notes](https://github.com/sagernet/sing-box/releases)
- [Changelog](https://github.com/SagerNet/sing-box/blob/v1.10.6/docs/changelog.md)
- [Commits](SagerNet/sing-box@v1.9.4...v1.10.6)

Updates `github.com/stretchr/testify` from 1.9.0 to 1.10.0
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.9.0...v1.10.0)

Updates `github.com/urfave/cli/v2` from 2.27.4 to 2.27.5
- [Release notes](https://github.com/urfave/cli/releases)
- [Changelog](https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md)
- [Commits](urfave/cli@v2.27.4...v2.27.5)

Updates `github.com/xtls/xray-core` from 1.8.23 to 1.8.24
- [Release notes](https://github.com/xtls/xray-core/releases)
- [Commits](XTLS/Xray-core@v1.8.23...v1.8.24)

Updates `golang.org/x/sync` from 0.8.0 to 0.10.0
- [Commits](golang/sync@v0.8.0...v0.10.0)

Updates `golang.org/x/time` from 0.6.0 to 0.8.0
- [Commits](golang/time@v0.6.0...v0.8.0)

Updates `google.golang.org/grpc` from 1.65.0 to 1.66.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.65.0...v1.66.0)

Updates `modernc.org/sqlite` from 1.32.0 to 1.34.4
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.32.0...v1.34.4)

---
updated-dependencies:
- dependency-name: github.com/getsentry/sentry-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/go-ping/ping
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/labstack/echo/v4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/prometheus/client_golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: github.com/prometheus/common
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/sagernet/sing
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/sagernet/sing-box
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/urfave/cli/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: github.com/xtls/xray-core
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: golang.org/x/sync
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/time
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: modernc.org/sqlite
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jan 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants