Bump the go_modules group across 1 directory with 8 updates #1

dependabot · 2025-02-26T22:20:38Z

Bumps the go_modules group with 7 updates in the / directory:

Package	From	To
golang.org/x/crypto	`0.14.0`	`0.31.0`
github.com/go-jose/go-jose/v3	`3.0.1`	`3.0.4`
filippo.io/age	`1.1.1`	`1.2.1`
github.com/Azure/azure-sdk-for-go/sdk/azidentity	`1.4.0`	`1.6.0`
github.com/cloudflare/circl	`1.3.5`	`1.3.7`
github.com/hashicorp/go-retryablehttp	`0.7.1`	`0.7.7`
google.golang.org/protobuf	`1.31.0`	`1.33.0`

Updates golang.org/x/crypto from 0.14.0 to 0.31.0

Commits

b4f1988 ssh: make the public key cache a 1-entry FIFO cache
7042ebc openpgp/clearsign: just use rand.Reader in tests
3e90321 go.mod: update golang.org/x dependencies
8c4e668 x509roots/fallback: update bundle
6018723 go.mod: update golang.org/x dependencies
71ed71b README: don't recommend go get
750a45f sha3: add MarshalBinary, AppendBinary, and UnmarshalBinary
36b1725 sha3: avoid trailing permutation
80ea76e sha3: fix padding for long cSHAKE parameters
c17aa50 sha3: avoid buffer copy
Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.4

Release notes

Sourced from github.com/go-jose/go-jose/v3's releases.

v3.0.4

What's Changed

Backport fix for GHSA-c6gw-w398-hv78 CVE-2025-27144 go-jose/go-jose#174

Full Changelog: go-jose/go-jose@v3.0.3...v3.0.4

Version 3.0.3

Fixed

Limit decompression output size to prevent a DoS. Backport from v4.0.1.

Version 3.0.2

Fixed

DecryptMulti: handle decompression error (#19)

Changed

jwe/CompactSerialize: improve performance (#67)

Increase the default number of PBKDF2 iterations to 600k (#48)

Return the proper algorithm for ECDSA keys (#45)

Update golang.org/x/crypto to v0.19 (#94)

Added

Add Thumbprint support for opaque signers (#38)

Changelog

Sourced from github.com/go-jose/go-jose/v3's changelog.

v4.0.4

Fixed

Reverted "Allow unmarshalling JSONWebKeySets with unsupported key types" as a breaking change. See #136 / #137.

v4.0.3

Changed

Allow unmarshalling JSONWebKeySets with unsupported key types (#130)

Document that OpaqueKeyEncrypter can't be implemented (for now) (#129)

Dependency updates

v4.0.2

Changed

Improved documentation of Verify() to note that JSONWebKeySet is a supported argument type (#104)

Defined exported error values for missing x5c header and unsupported elliptic curves error cases (#117)

v4.0.1

Fixed

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.

v4.0.0

This release makes some breaking changes in order to more thoroughly address the vulnerabilities discussed in [Three New Attacks Against JSON Web Tokens][1], "Sign/encrypt confusion", "Billion hash attack", and "Polyglot token".

Changed

Limit JWT encryption types (exclude password or public key types) (#78)

Enforce minimum length for HMAC keys (#85)

jwt: match any audience in a list, rather than requiring all audiences (#81)

jwt: accept only Compact Serialization (#75)

jws: Add expected algorithms for signatures (#74)

Require specifying expected algorithms for ParseEncrypted,

... (truncated)

Commits

5253038 Backport fix 167 to v3 (#174)
047dc99 CI: Update github actions and go version (#173)
0f017e9 Revert #26 (ignore unsupported JWKs in Sets) (#131)
3e2bbef Unmarshal jwk keys with unsupported key type or algorithm into empty … (#26)
add6a28 v3: backport decompression limit fix (#107)
11bb4e7 doc: in v3 branch's README, point to v4 as latest (#101)
863f73b v3.0.2: Update changelog (#95)
bdbc794 Update golang.org/x/crypto to v0.19 (backport) (#94)
25bce79 Updated go-jose v3.0.0 to v3.0.1 in jose-util (#70)
aa386df jwe/CompactSerialize: improve performance. (#67)
Additional commits viewable in compare view

Updates filippo.io/age from 1.1.1 to 1.2.1

Release notes

Sourced from filippo.io/age's releases.

age v1.2.1: security fix

This release fixes a security vulnerability that could allow an attacker to execute an arbitrary binary under certain conditions.

See GHSA-32gq-x56h-299c.

Plugin names may now only contain alphanumeric characters or the four special characters +-._.

Thanks to ⬡-49016 for reporting this issue.

age v1.2.0

A small release to build the release binaries with a more recent Go toolchain, and to fix a couple CLI edge cases (FiloSottile/age#491, FiloSottile/age#555).

The Go module now exposes a plugin package that provides an age plugin client. That is, Recipient and Identity implementations that invoke a plugin binary, allowing the use of age plugins in Go programs.

Finally, Recipients can now return a set of "labels" by implementing RecipientWithLabels. This allows replicating the special behavior of the scrypt Recipient in third-party Recipients, or applying policy useful for authenticated or post-quantum Recipients.
// RecipientWithLabels can be optionally implemented by a Recipient, in which
// case Encrypt will use WrapWithLabels instead of Wrap.
//
// Encrypt will succeed only if the labels returned by all the recipients
// (assuming the empty set for those that don't implement RecipientWithLabels)
// are the same.
//
// This can be used to ensure a recipient is only used with other recipients
// with equivalent properties (for example by setting a "postquantum" label) or
// to ensure a recipient is always used alone (by returning a random label, for
// example to preserve its authentication properties).
type RecipientWithLabels interface {
	WrapWithLabels(fileKey []byte) (s []*Stanza, labels []string, err error)
}

Commits

482cf6f plugin: restrict characters in plugin names
cda3988 all: fix staticcheck warnings (#589)
176e245 README: rotate Sigsum keys
faefdc3 README: document Sigsum proofs
bbe6ce5 .github/workflows: update artifacts Actions
1e1bada .github/workflows: go-version stable, not latest
2293a9a .github/workflows: use latest Go for bootstrap
01fe9cd README: add pkgx installation instructions
bd0511b cmd/age: detect output/input file reuse when possible
febaade cmd/age: create file for empty decryptions
Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.4.0 to 1.6.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/storage/azblob/v1.6.0

1.6.0 (2025-01-23)

Features Added

Upgraded service version to 2025-01-05.

sdk/storage/azblob/v1.6.0-beta.1

1.6.0-beta.1 (2025-01-13)

Features Added

Added permissions & resourcetype parameters in listblob response.

Added BlobProperties field in BlobPrefix definition in listblob response.

Bugs Fixed

Fix FilterBlob API if Query contains a space character. Fixes #23546

sdk/storage/azfile/v1.5.1-beta.1

1.5.1-beta.1 (2025-02-12)

Features Added

Upgraded service version to 2025-05-05.

NFS Over Rest API Request/Response changes in the following APIs - CreateFile SetFileProperties GetFileProperties StartCopyFromUrl DownloadFile DeleteFile CreateDirectory GetDirectoryProperties SetDirectoryProperties

NFS Over Rest, new API File CreateHardLink() Added

Breaking Changes

The following APIs no longer send the x-ms-file-permission-key, x-ms-file-attributes, x-ms-file-creation-time, and x-ms-file-last-write-time request headers by default. These headers have been optional in the REST API since x-ms-version 2021-06-08: FileClient.Create() FileClient.SetHttpHeaders() DirectoryClient.Create() DirectoryClient.SetHttpHeaders()

sdk/storage/azblob/v1.5.0

1.5.0 (2024-11-13)

Features Added

Fix compareHeaders custom sorting algorithm for String To Sign.

Added permissions & resourcetype parameters in listblob response.

sdk/storage/azfile/v1.5.0

1.5.0 (2025-01-23)

... (truncated)

Commits

36f766d add sdk/resourcemanager/cosmos/armcosmos live test (#20705)
c005ed6 sdk/resourcemanager/network/armnetwork live test (#20331)
5fa7df4 add sdk/resourcemanager/compute/armcompute live test (#20048)
0d22aed add sdk/resourcemanager/eventhub/armeventhub live test (#20686)
2a8d96d add sdk/resourcemanager/postgresql/armpostgresql live test (#20685)
b2cddab [Release] sdk/resourcemanager/paloaltonetworksngfw/armpanngfw/0.1.0 (#20437)
ed7f3c7 Fix azidentity troubleshooting guide link (#20736)
6dfd0cb [azeventhubs] Fixing checkpoint store race condition (#20727)
745d967 pass along the artifact name so we can override it later (#20732)
20b4dd8 Update changelog with latest features (#20730)
Additional commits viewable in compare view

Updates github.com/cloudflare/circl from 1.3.5 to 1.3.7

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.3.7

What's Changed

build(deps): bump golang.org/x/crypto from 0.3.1-0.20221117191849-2c476679df9a to 0.17.0 by @dependabot in cloudflare/circl#467

kyber: remove division by q in ciphertext compression by @bwesterb in cloudflare/circl#468

Releasing CIRCL v1.3.7 by @armfazh in cloudflare/circl#469

New Contributors

@dependabot made their first contribution in cloudflare/circl#467

Full Changelog: cloudflare/circl@v1.3.6...v1.3.7

CIRCL v1.3.6

What's Changed

internal: add TurboShake{128,256} by @bwesterb in cloudflare/circl#430

Kangaroo12 draft -10 by @bwesterb in cloudflare/circl#431

Add K12 as XOF by @bwesterb in cloudflare/circl#437

xof/k12: Fix a typo in the package documentation by @cjpatton in cloudflare/circl#438

Set CIRCL version for generated assembler code. by @armfazh in cloudflare/circl#440

Add tkn20 benchmarks by @tanyav2 in cloudflare/circl#442

Add partially blind RSA implementation by @chris-wood in cloudflare/circl#445

Update doc.go by @nadimkobeissi in cloudflare/circl#447

tss/rsa: key generation for threshold RSA (safe primes) by @armfazh in cloudflare/circl#450

Bumping Go version for CI jobs. by @armfazh in cloudflare/circl#457

Spelling by @jsoref in cloudflare/circl#456

blindrsa: updating blindrsa to be compliant with RFC9474 by @armfazh in cloudflare/circl#464

Releasing CIRCL v1.3.6 by @armfazh in cloudflare/circl#465

New Contributors

@nadimkobeissi made their first contribution in cloudflare/circl#447

@jsoref made their first contribution in cloudflare/circl#456

Full Changelog: cloudflare/circl@v1.3.3...v1.3.6

Commits

c48866b Releasing CIRCL v1.3.7
75ef91e kyber: remove division by q in ciphertext compression
899732a build(deps): bump golang.org/x/crypto
99f0f71 Releasing CIRCL v1.3.6
e728d0d Apply thibmeu code review suggestions
ceb2d90 Updating blindrsa to be compliant with RFC9474.
See full diff in compare view

Updates github.com/hashicorp/go-retryablehttp from 0.7.1 to 0.7.7

Changelog

Sourced from github.com/hashicorp/go-retryablehttp's changelog.

0.7.7 (May 30, 2024)

BUG FIXES:

client: avoid potentially leaking URL-embedded basic authentication credentials in logs (#158)

0.7.6 (May 9, 2024)

ENHANCEMENTS:

client: support a RetryPrepare function for modifying the request before retrying (#216)

client: support HTTP-date values for Retry-After header value (#138)

client: avoid reading entire body when the body is a *bytes.Reader (#197)

BUG FIXES:

client: fix a broken check for invalid server certificate in go 1.20+ (#210)

0.7.5 (Nov 8, 2023)

BUG FIXES:

client: fixes an issue where the request body is not preserved on temporary redirects or re-established HTTP/2 connections (#207)

0.7.4 (Jun 6, 2023)

BUG FIXES:

client: fixing an issue where the Content-Type header wouldn't be sent with an empty payload when using HTTP/2 (#194)

0.7.3 (May 15, 2023)

Initial release

Commits

1542b31 v0.7.7
defb9f4 v0.7.7
a99f07b Merge pull request #158 from dany74q/danny/redacted-url-in-logs
8a28c57 Merge branch 'main' into danny/redacted-url-in-logs
86e852d Merge pull request #227 from hashicorp/dependabot/github_actions/actions/chec...
47fe99e Bump actions/checkout from 4.1.5 to 4.1.6
490fc06 Merge pull request #226 from testwill/ioutil
f3e9417 chore: remove refs to deprecated io/ioutil
d969eaa Merge pull request #225 from hashicorp/manicminer-patch-2
2ad8ed4 v0.7.6
Additional commits viewable in compare view

Updates golang.org/x/net from 0.17.0 to 0.26.0

Commits

66e838c go.mod: update golang.org/x dependencies
6249541 http2: avoid race in server handler SetReadDeadine/SetWriteDeadline
603e3e6 quic: disable X25519Kyber768Draft00 in tests
67e8d0c http2: report an error if goroutines outlive serverTester tests
5608279 http2: avoid corruption in priority write scheduler
0d515a5 http2: factor out frame read/write test functions
9f5b79b http2: drop unused retry function
03c24c2 http2: use synthetic time in server tests
022530c http2: add a more full-featured test net.Conn
410d19e http2: avoid racy access to clientStream.requestedGzip
Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.31.0 to 1.33.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the go_modules group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.14.0` | `0.31.0` | | [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) | `3.0.1` | `3.0.4` | | [filippo.io/age](https://github.com/FiloSottile/age) | `1.1.1` | `1.2.1` | | [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) | `1.4.0` | `1.6.0` | | [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | `1.3.5` | `1.3.7` | | [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) | `0.7.1` | `0.7.7` | | google.golang.org/protobuf | `1.31.0` | `1.33.0` | Updates `golang.org/x/crypto` from 0.14.0 to 0.31.0 - [Commits](golang/crypto@v0.14.0...v0.31.0) Updates `github.com/go-jose/go-jose/v3` from 3.0.1 to 3.0.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Changelog](https://github.com/go-jose/go-jose/blob/main/CHANGELOG.md) - [Commits](go-jose/go-jose@v3.0.1...v3.0.4) Updates `filippo.io/age` from 1.1.1 to 1.2.1 - [Release notes](https://github.com/FiloSottile/age/releases) - [Commits](FiloSottile/age@v1.1.1...v1.2.1) Updates `github.com/Azure/azure-sdk-for-go/sdk/azidentity` from 1.4.0 to 1.6.0 - [Release notes](https://github.com/Azure/azure-sdk-for-go/releases) - [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/release.md) - [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.4.0...sdk/azcore/v1.6.0) Updates `github.com/cloudflare/circl` from 1.3.5 to 1.3.7 - [Release notes](https://github.com/cloudflare/circl/releases) - [Commits](cloudflare/circl@v1.3.5...v1.3.7) Updates `github.com/hashicorp/go-retryablehttp` from 0.7.1 to 0.7.7 - [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md) - [Commits](hashicorp/go-retryablehttp@v0.7.1...v0.7.7) Updates `golang.org/x/net` from 0.17.0 to 0.26.0 - [Commits](golang/net@v0.17.0...v0.26.0) Updates `google.golang.org/protobuf` from 1.31.0 to 1.33.0 --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v3 dependency-type: indirect dependency-group: go_modules - dependency-name: filippo.io/age dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azidentity dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/cloudflare/circl dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/hashicorp/go-retryablehttp dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label Feb 26, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the go_modules group across 1 directory with 8 updates #1

Bump the go_modules group across 1 directory with 8 updates #1

dependabot bot commented on behalf of github Feb 26, 2025

Bump the go_modules group across 1 directory with 8 updates #1

Are you sure you want to change the base?

Bump the go_modules group across 1 directory with 8 updates #1

Conversation

dependabot bot commented on behalf of github Feb 26, 2025

v3.0.4

What's Changed

Version 3.0.3

Fixed

Version 3.0.2

Fixed

Changed

Added

v4.0.4

Fixed

v4.0.3

Changed

v4.0.2

Changed

v4.0.1

Fixed

v4.0.0

Changed

age v1.2.1: security fix

age v1.2.0

sdk/storage/azblob/v1.6.0

1.6.0 (2025-01-23)

Features Added

sdk/storage/azblob/v1.6.0-beta.1

1.6.0-beta.1 (2025-01-13)

Features Added

Bugs Fixed

sdk/storage/azfile/v1.5.1-beta.1

1.5.1-beta.1 (2025-02-12)

Features Added

Breaking Changes

sdk/storage/azblob/v1.5.0

1.5.0 (2024-11-13)

Features Added

sdk/storage/azfile/v1.5.0

1.5.0 (2025-01-23)

CIRCL v1.3.7

What's Changed

New Contributors

CIRCL v1.3.6

What's Changed

New Contributors

0.7.7 (May 30, 2024)

0.7.6 (May 9, 2024)

0.7.5 (Nov 8, 2023)

0.7.4 (Jun 6, 2023)

0.7.3 (May 15, 2023)