chore(deps): update all dependencies #408
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
![narwhal-bot[bot]](https://avatars.githubusercontent.com/in/382791?s=60&v=4){kind=small}
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
renovate
bot
force-pushed
the
renovate/all
branch
from
091897e
to
2308adb
Compare
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
bot
force-pushed
the
renovate/all
branch
21 times, most recently
from
0590717
to
32762ad
Compare
renovate
bot
force-pushed
the
renovate/all
branch
20 times, most recently
from
8fd34df
to
e5b51ea
Compare
renovate
bot
force-pushed
the
renovate/all
branch
3 times, most recently
from
f522487
to
4a29b6a
Compare
renovate
bot
force-pushed
the
renovate/all
branch
from
4a29b6a
to
87c5a0d
Compare
|
/update autoformat |
ntwkninja
approved these changes
Aug 14, 2024
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.91.0->v1.92.12.4.2->2.5.02.0.9->2.0.34v1.51.6->v1.55.5v0.0.5->v0.0.6v0.0.13->v0.0.17v0.0.17->v0.0.23v0.0.3->v0.0.7v0.1.7->v0.1.11v0.46.13->v0.47.0v1.7.3->v1.7.5v0.20.0->v0.23.0v0.29.3->v0.31.0v0.29.3->v0.31.0v0.29.3->v0.31.037.410.2->38.29.0v0.6.18->v0.6.22~> 2.0->~> 3.0Note: The
pre-commitmanager in Renovate is not supported by thepre-commitmaintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.GitHub Vulnerability Alerts
CVE-2024-3817
When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.
An attacker may format a Git URL in order to inject additional Git arguments to the Git call.
Consumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later.
CVE-2024-6257
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .
An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.
Argument injection when fetching remote default Git branches in github.com/hashicorp/go-getter
CVE-2024-3817 / GHSA-q64h-39hv-4cf7 / GO-2024-2800
More information
Details
When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository's HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.
An attacker may format a Git URL in order to inject additional Git arguments to the Git call.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
CVE-2024-3817 / GHSA-q64h-39hv-4cf7 / GO-2024-2800
More information
Details
When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.
An attacker may format a Git URL in order to inject additional Git arguments to the Git call.
Consumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation
CVE-2024-6257 / GHSA-xfhp-jf8p-mh5w / GO-2024-2948
More information
Details
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .
An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.
Severity
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Code Execution on Git update in github.com/hashicorp/go-getter
CVE-2024-6257 / GHSA-xfhp-jf8p-mh5w / GO-2024-2948
More information
Details
A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config in the provided destination. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
CVE-2023-45288
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
HTTP/2 CONTINUATION flood in net/http
BIT-golang-2023-45288 / CVE-2023-45288 / GHSA-4v7x-pqxf-cx7m / GO-2024-2687
More information
Details
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.
Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed.
This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.
The fix sets a limit on the amount of excess header frames we will process before closing a connection.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
net/http, x/net/http2: close connections when receiving too many headers
BIT-golang-2023-45288 / CVE-2023-45288 / GHSA-4v7x-pqxf-cx7m / GO-2024-2687
More information
Details
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
antonbabenko/pre-commit-terraform (antonbabenko/pre-commit-terraform)
v1.92.1Compare Source
Bug Fixes
terraform_docs: Suppress "terraform command not found" error message in case binary does not exist (#693) (6ff3572)v1.92.0Compare Source
Features
terragrunt_validate_inputshook to check unused and undefined inputs (#677) (a139b71)hashicorp/terraform-provider-archive (archive)
v2.5.0Compare Source
ENHANCEMENTS:
excludesattribute. (#354)excludesattribute. (#354)defenseunicorns/build-harness (defenseunicorns/build-harness)
v2.0.34Compare Source
Miscellaneous Chores
v2.0.33Compare Source
Miscellaneous Chores
v2.0.32Compare Source
Miscellaneous Chores
v2.0.31Compare Source
Miscellaneous Chores
v2.0.30Compare Source
Miscellaneous Chores
v2.0.29Compare Source
Miscellaneous Chores
v2.0.28Compare Source
Miscellaneous Chores
v2.0.27Compare Source
Miscellaneous Chores
v2.0.26Compare Source
Miscellaneous Chores
v2.0.25Compare Source
Miscellaneous Chores
v2.0.24Compare Source
Miscellaneous Chores
v2.0.23Compare Source
Miscellaneous Chores
v2.0.22Compare Source
Miscellaneous Chores
v2.0.21Compare Source
Miscellaneous Chores
v2.0.20Compare Source
Miscellaneous Chores
v2.0.19Compare Source
Miscellaneous Chores
v2.0.18Compare Source
Miscellaneous Chores
v2.0.17Compare Source
Miscellaneous Chores
v2.0.16Compare Source
Miscellaneous Chores
v2.0.15Compare Source
Miscellaneous Chores
v2.0.14Compare Source
Miscellaneous Chores
v2.0.13Compare Source
Miscellaneous Chores
v2.0.12Compare Source
Miscellaneous Chores
v2.0.11Compare Source
Miscellaneous Chores
v2.0.10Compare Source
Miscellaneous Chores
aws/aws-sdk-go (github.com/aws/aws-sdk-go)
v1.55.5Compare Source
===
Service Client Updates
service/appstream: Updates service API and documentationservice/autoscaling: Updates service API and documentationservice/codepipeline: Updates service API, documentation, and paginatorsservice/elasticache: Updates service documentationservice/elasticloadbalancing: Updates service APIservice/eventbridge: Updates service APIservice/logs: Updates service APIservice/models.lex.v2: Updates service API and documentationservice/rolesanywhere: Updates service API and documentationservice/tnb: Updates service API and documentationservice/workspaces: Updates service documentationv1.55.4Compare Source
===
Service Client Updates
service/elasticache: Updates service documentationservice/memorydb: Updates service API and documentationv1.55.3Compare Source
===
Service Client Updates
service/application-autoscaling: Updates service APIservice/application-signals: Updates service API and documentationservice/bedrock-runtime: Updates service API and documentationservice/codecommit: Updates service API and documentationservice/datazone: Updates service API and documentationservice/ec2: Updates service API and documentationservice/ecr: Updates service API, documentation, paginators, and examplesservice/eks: Updates service API and documentationservice/elasticloadbalancingv2: Updates service API, documentation, and examplesservice/network-firewall: Updates service API and documentationservice/outposts: Updates service API and documentationservice/states: Updates service API and documentationSDK Bugs
v1.55.2Compare Source
===
Service Client Updates
service/cleanrooms: Updates service API and documentationservice/dynamodb: Updates service API, documentation, waiters, paginators, and examplesservice/iotsitewise: Updates service API and documentationservice/mediapackagev2: Updates service APIservice/medical-imaging: Updates service API and documentationservice/pinpoint-sms-voice-v2: Updates service API and documentationSDK Bugs
v1.55.1Compare Source
===
Service Client Updates
service/appsync: Updates service API and paginatorsservice/cleanrooms: Updates service API, documentation, and paginatorsservice/cleanroomsml: Updates service API, documentation, and waitersservice/connect: Updates service API and documentationservice/connect-contact-lens: Updates service API and documentationservice/datazone: Updates service API and documentationservice/entityresolution: Updates service API and documentation[`v1.55
Configuration
📅 Schedule: Branch creation - "after 4am and before 10am on Monday" in timezone America/New_York, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.