8000 build(deps): bump the go_modules group across 2 directories with 10 updates by dependabot[bot] · Pull Request #1 · AskAlice/homelab · GitHub
[go: up one dir, main page]
Skip to content

build(deps): bump the go_modules group across 2 directories with 10 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/platform/vault/files/generate-secrets/go_modules-edd6fc734f
Open

build(deps): bump the go_modules group across 2 directories with 10 updates#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/platform/vault/files/generate-secrets/go_modules-edd6fc734f

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Jun 22, 2026
Copy link
Copy Markdown

Bumps the go_modules group with 3 updates in the /platform/vault/files/generate-secrets directory: github.com/hashicorp/go-retryablehttp, golang.org/x/crypto and google.golang.org/grpc.
Bumps the go_modules group with 3 updates in the /test directory: golang.org/x/crypto, google.golang.org/grpc and github.com/hashicorp/go-getter.

Updates github.com/hashicorp/go-retryablehttp from 0.6.6 to 0.7.7

Changelog

Sourced from github.com/hashicorp/go-retryablehttp's changelog.

0.7.7 (May 30, 2024)

BUG FIXES:

  • client: avoid potentially leaking URL-embedded basic authentication credentials in logs (#158)

0.7.6 (May 9, 2024)

ENHANCEMENTS:

  • client: support a RetryPrepare function for modifying the request before retrying (#216)
  • client: support HTTP-date values for Retry-After header value (#138)
  • client: avoid reading entire body when the body is a *bytes.Reader (#197)

BUG FIXES:

  • client: fix a broken check for invalid server certificate in go 1.20+ (#210)

0.7.5 (Nov 8, 2023)

BUG FIXES:

  • client: fixes an issue where the request body is not preserved on temporary redirects or re-established HTTP/2 connections (#207)

0.7.4 (Jun 6, 2023)

BUG FIXES:

  • client: fixing an issue where the Content-Type header wouldn't be sent with an empty payload when using HTTP/2 (#194)

0.7.3 (May 15, 2023)

Initial release

Commits
  • 1542b31 v0.7.7
  • defb9f4 v0.7.7
  • a99f07b Merge pull request #158 from dany74q/danny/redacted-url-in-logs
  • 8a28c57 Merge branch 'main' into danny/redacted-url-in-logs
  • 86e852d Merge pull request #227 from hashicorp/dependabot/github_actions/actions/chec...
  • 47fe99e Bump actions/checkout from 4.1.5 to 4.1.6
  • 490fc06 Merge pull request #226 from testwill/ioutil
  • f3e9417 chore: remove refs to deprecated io/ioutil
  • d969eaa Merge pull request #225 from hashicorp/manicminer-patch-2
  • 2ad8ed4 v0.7.6
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.0.0-20210711020723-a769d52b0f97 to 0.45.0

Commits

Updates golang.org/x/net from 0.0.0-20210226172049-e18ecbb05110 to 0.47.0

Commits

Updates golang.org/x/sys from 0.0.0-20210630005230-0f9fa26af87c to 0.38.0

Commits

Updates golang.org/x/text from 0.3.3 to 0.31.0

Commits
  • e7ff6b3 go.mod: update golang.org/x dependencies
  • fbf012b all: use reflect.TypeFor instead of reflect.TypeOf
  • c6abd03 go.mod: update golang.org/x dependencies
  • 42f038d x/text: fix nil dereference in gotext extract
  • a42f0e2 all: use built-in max/min to simplify the code
  • e69f31b go.mod: update golang.org/x dependencies
  • 60c9786 all: upgrade go directive to at least 1.24.0 [generated]
  • 425d715 go.mod: update golang.org/x dependencies
  • b6d2645 go.mod: update golang.org/x dependencies
  • 8072180 go.mod: update golang.org/x dependencies
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.41.0 to 1.79.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

  • server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

  • stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

  • mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)
  • experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

  • balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

  • experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)
  • pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
    • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)
  • xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)
  • balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Bug Fixes

  • credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)
  • xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)
  • health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)
  • transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)
  • server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Performance Improvements

  • credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)
  • mem: Optimize pooling and creation of buffer objects. (#8784)
  • transport: Reduce slice re-allocations by reserving slice capacity. (#8797)

... (truncated)

Commits

Updates google.golang.org/protobuf from 1.26.0 to 1.36.10

Updates golang.org/x/crypto from 0.0.0-20210513164829-c07d793c2f9a to 0.45.0

Commits

Updates golang.org/x/net from 0.0.0-20210614182718-04defd469f4e to 0.47.0

Commits

Updates golang.org/x/text from 0.3.6 to 0.31.0

Commits
  • e7ff6b3 go.mod: update golang.org/x dependencies
  • fbf012b all: use reflect.TypeFor instead of reflect.TypeOf
  • c6abd03 go.mod: update golang.org/x dependencies
  • 42f038d x/text: fix nil dereference in gotext extract
  • a42f0e2 all: use built-in max/min to simplify the code
  • e69f31b go.mod: update golang.org/x dependencies
  • 60c9786 all: upgrade go directive to at least 1.24.0 [generated]
  • 425d715 go.mod: update golang.org/x dependencies
  • b6d2645 go.mod: update golang.org/x dependencies
  • 8072180 go.mod: update golang.org/x dependencies
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.38.0 to 1.79.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

  • server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

  • stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

  • mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)
  • experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

  • balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

  • experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)
  • pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
    • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)
  • xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)
  • balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Bug Fixes

  • credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)
  • xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)
  • health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)
  • transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)
  • server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Performance Improvements

  • credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)
  • mem: Optimize pooling and creation of buffer objects. (#8784)
  • transport: Reduce slice re-allocations by reserving slice capacity. (#8797)

... (truncated)

Commits

Updates google.golang.org/protobuf from 1.26.0 to 1.36.10

Updates github.com/hashicorp/go-getter from 1.6.1 to 1.8.6

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.8.6

No release notes provided.

v1.8.5

What's Changed

NOTES:

Binary Distribution Update: To streamline our release process and align with other HashiCorp tools, all release binaries will now be published exclusively to the official HashiCorp release site. We will no longer attach release assets to GitHub Releases.

New Contributors

Full Changelog: hashicorp/go-getter@v1.8.4...v1.8.5

v1.8.4

What's Changed

... (truncated)

Commits
  • d23bff4 Merge pull request #608 from hashicorp/dependabot/go_modules/go-security-9c51...
  • 2c4aba8 Merge pull request #613 from hashicorp/pull/v1.8.6
  • fe61ed9 Merge pull request #611 from hashicorp/SECVULN-41053
  • d533656 Merge pull request #606 from hashicorp/pull/CRT
  • 388f23d Additional test for local branch and head
  • b7ceaa5 harden checkout ref handling and added regression tests
  • 769cc14 Release version bump up
  • 6086a6a Review Comments Addressed
  • e02063c Revert "SECVULN Fix for git checkout argument injection enables arbitrary fil...
  • c93084d [chore] : Bump google.golang.org/grpc
  • Additional commits viewable in compare view

Updates github.com/ulikunitz/xz from 0.5.8 to 0.5.15

Commits

Updates golang.org/x/oauth2 from 0.0.0-20210514164344-f6687ab2804c to 0.36.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the go_modules group across 2 directories with 10 u…
ff2eed3 
…pdates

Bumps the go_modules group with 3 updates in the /platform/vault/files/generate-secrets directory: [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp), [golang.org/x/crypto](https://github.com/golang/crypto) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).
Bumps the go_modules group with 3 updates in the /test directory: [golang.org/x/crypto](https://github.com/golang/crypto), [google.golang.org/grpc](https://github.com/grpc/grpc-go) and [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter).


Updates `github.com/hashicorp/go-retryablehttp` from 0.6.6 to 0.7.7
- [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md)
- [Commits](hashicorp/go-retryablehttp@v0.6.6...v0.7.7)

Updates `golang.org/x/crypto` from 0.0.0-20210711020723-a769d52b0f97 to 0.45.0
- [Commits](https://github.com/golang/crypto/commits/v0.45.0)

Updates `golang.org/x/net` from 0.0.0-20210226172049-e18ecbb05110 to 0.47.0
- [Commits](https://github.com/golang/net/commits/v0.47.0)

Updates `golang.org/x/sys` from 0.0.0-20210630005230-0f9fa26af87c to 0.38.0
- [Commits](https://github.com/golang/sys/commits/v0.38.0)

Updates `golang.org/x/text` from 0.3.3 to 0.31.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.3.3...v0.31.0)

Updates `google.golang.org/grpc` from 1.41.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.41.0...v1.79.3)

Updates `google.golang.org/protobuf` from 1.26.0 to 1.36.10

Updates `golang.org/x/crypto` from 0.0.0-20210513164829-c07d793c2f9a to 0.45.0
- [Commits](https://github.com/golang/crypto/commits/v0.45.0)

Updates `golang.org/x/net` from 0.0.0-20210614182718-04defd469f4e to 0.47.0
- [Commits](https://github.com/golang/net/commits/v0.47.0)

Updates `golang.org/x/text` from 0.3.6 to 0.31.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.3.3...v0.31.0)

Updates `google.golang.org/grpc` from 1.38.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.41.0...v1.79.3)

Updates `google.golang.org/protobuf` from 1.26.0 to 1.36.10

Updates `github.com/hashicorp/go-getter` from 1.6.1 to 1.8.6
- [Release notes](https://github.com/hashicorp/go-getter/releases)
- [Commits](hashicorp/go-getter@v1.6.1...v1.8.6)

Updates `github.com/ulikunitz/xz` from 0.5.8 to 0.5.15
- [Commits](ulikunitz/xz@v0.5.8...v0.5.15)

Updates `golang.org/x/oauth2` from 0.0.0-20210514164344-f6687ab2804c to 0.36.0
- [Commits](https://github.com/golang/oauth2/commits/v0.36.0)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-retryablehttp
  dependency-version: 0.7.7
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-version: 0.47.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/sys
  dependency-version: 0.38.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/text
  dependency-version: 0.31.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.10
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-version: 0.47.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/text
  dependency-version: 0.31.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.10
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/hashicorp/go-getter
  dependency-version: 1.8.6
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/ulikunitz/xz
  dependency-version: 0.5.15
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.36.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 22, 2026
@socket-security
socket-security Bot commented Jun 22, 2026
Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: golang github.com/googleapis/enterprise-certificate-proxy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ? → golang/github.com/gruntwork-io/terratest@v0.40.18 → golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.14

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: golang github.com/hashicorp/aws-sdk-go-base/v2 is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ? → golang/github.com/gruntwork-io/terratest@v0.40.18 → golang/github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.72

ℹ Read more on: Th 8000 is package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.72. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: golang github.com/planetscale/vtprotobuf is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ? → golang/github.com/gruntwork-io/terratest@v0.40.18 → golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

0