[release/2.8] update to go1.20.8 #4056
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 84a85a4) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
…recated We need to look into this; can we remove it, or is there a replacement? Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit ebe9d67) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Removing the "structcheck" and "varcheck" linters as they've been deprecated.
level=warning msg="[runner] The linter 'structcheck' is deprecated (since v1.49.0) due to: The owner seems to have abandoned the linter. Replaced by unused."
level=warning msg="[runner] The linter 'varcheck' is deprecated (since v1.49.0) due to: The owner seems to have abandoned the linter. Replaced by unused."
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit dec03ea)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This addresses CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405 which were patched in 1.19.10. Signed-off-by: Ben Manuel <ben.manuel@procore.com> (cherry picked from commit 36dd5b7) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com> (cherry picked from commit 0eb8fee) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com> (cherry picked from commit 1a3e73c) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
go1.20.8 (released 2023-09-06) includes two security fixes to the html/template package, as well as bug fixes to the compiler, the go command, the runtime, and the crypto/tls, go/types, net/http, and path/filepath packages. See the Go 1.20.8 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.20.8+label%3ACherryPickApproved full diff: golang/go@go1.20.7...go1.20.8 From the security mailing: [security] Go 1.21.1 and Go 1.20.8 are released Hello gophers, We have just released Go versions 1.21.1 and 1.20.8, minor point releases. These minor releases include 4 security fixes following the security policy: - cmd/go: go.mod toolchain directive allows arbitrary execution The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software. Thanks to Juho Nurminen of Mattermost for reporting this issue. This is CVE-2023-39320 and Go issue https://go.dev/issue/62198. - html/template: improper handling of HTML-like comments within script contexts The html/template package did not properly handle HMTL-like "<!--" and "-->" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2023-39318 and Go issue https://go.dev/issue/62196. - html/template: improper handling of special tags within script contexts The html/template package did not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2023-39319 and Go issue https://go.dev/issue/62197. - crypto/tls: panic when processing post-handshake message on QUIC connections Processing an incomplete post-handshake message for a QUIC connection caused a panic. Thanks to Marten Seemann for reporting this issue. This is CVE-2023-39321 and CVE-2023-39322 and Go issue https://go.dev/issue/62266. Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 23115ff) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
force-pushed
the
2.8_backport_update_golang_1.20.8
branch
from
1fc30b2
to
3c6f778
Compare
milosgajdos
approved these changes
Sep 12, 2023
Merged
nrdufour
added a commit
to nrdufour/home-ops
that referenced
this pull request
Oct 3, 2023
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [registry](https://github.com/distribution/distribution) | patch | `2.8.2` -> `2.8.3` | --- ### ⚠ Dependency Lookup Warnings ⚠ Warnings were logged while processing this repo. Please check the logs for more information. --- ### Release Notes <details> <summary>distribution/distribution (registry)</summary> ### [`v2.8.3`](https://github.com/distribution/distribution/releases/tag/v2.8.3) [Compare Source](distribution/distribution@v2.8.2...v2.8.3) ##### What's Changed - Pass `BUILDTAGS` argument to `go build` by [@​marcusirgens](https://github.com/marcusirgens) in distribution/distribution#3926 - Enable Go build tags by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4009 - `reference`: replace deprecated function `SplitHostname` by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4032 - Dont parse errors as JSON unless Content-Type is set to JSON by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4054 - update to go 1.20.8 by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4056 - Set `Content-Type` header in registry client `ReadFrom` by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4053 - deprecate reference package, migrate to github.com/distribution/reference by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4063 - `digestset`: deprecate package in favor of `go-digest/digestset` by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4064 - Do not close HTTP request body in HTTP handler by [@​milosgajdos](https://github.com/milosgajdos) in distribution/distribution#4068 - Add v2.8.3 release notes by [@​milosgajdos](https://github.com/milosgajdos) in distribution/distribution#4088 ##### New Contributors - [@​marcusirgens](https://github.com/marcusirgens) made their first contribution in distribution/distribution#3926 **Full Changelog**: distribution/distribution@v2.8.2...v2.8.3 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zLjIiLCJ1cGRhdGVkSW5WZXIiOiIzNy4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=--> Reviewed-on: https://git.home/nrdufour/home-ops/pulls/127 Co-authored-by: Renovate <renovate@ptinem.io> Co-committed-by: Renovate <renovate@ptinem.io>
Mengkzhaoyun
pushed a commit
to open-beagle/distribution
that referenced
this pull request
Dec 14, 2023
registry 2.8.3 Welcome to the v2.8.3 release of registry! Welcome to the 2.8.3 release of registry! The 2.8.3 registry release fixes a few bugs and makes a few dependency updates. The Go runtime has been bumped to 1.20.8. See the changelog below for full list of changes. * Do not close HTTP request body in HTTP handler ([distribution#4068](distribution#4068)) * Set Content-Type header in registry client ReadFrom ([distribution#4053](distribution#4053)) * Do not parse errors as JSON unless Content-Type is set to JSON ([distribution#4054](distribution#4054)) * Enable Go build tags ([distribution#4009](distribution#4009)) * replace deprecated function SplitHostname ([distribution#4032](distribution#4032)) * update to go1.20.8 ([distribution#4056](distribution#4056)) * deprecate digestset package in favor of go-digest/digestset ([distribution#4064](distribution#4064)) * deprecate reference package, migrate to github.com/distribution/reference ([distribution#4063](distribution#4063)) Previous release can be found at [v2.8.2](https://github.com/distribution/distribution/releases/tag/v2.8.2) Please try out the release binaries and report any issues at https://github.com/distribution/distribution/issues. * Milos Gajdos * Sebastiaan van Stijn * Milos Gajdos * James Hewitt * Ben Manuel * Marcus Pettersen Irgens * zounengren <details><summary>30 commits</summary> <p> * Add v2.8.3 release notes ([distribution#4088](distribution#4088)) * [`a4fa6992`](distribution@a4fa699) Add v2.8.3 release notes * [release/2.8] Do not close HTTP request body in HTTP handler ([distribution#4068](distribution#4068)) * [`5e6b1b5c`](distribution@5e6b1b5) Do not close HTTP request body in HTTP handler * [release/2.8] digestset: deprecate package in favor of go-digest/digestset ([distribution#4064](distribution#4064)) * [`29b00e8b`](distribution@29b00e8) digestset: deprecate package in favor of go-digest/digestset * [`d1ab2430`](distribution@d1ab243) [release/2.8] vendor: github.com/opencontainers/go-digest v1.0.0 * [release/2.8] deprecate reference package, migrate to github.com/distribution/reference ([distribution#4063](distribution#4063)) * [`3dda0677`](distribution@3dda067) deprecate reference package, migrate to github.com/distribution/reference * [release/2.8 backport] Set Content-Type header in registry client ReadFrom ([distribution#4053](distribution#4053)) * [`cb121c3f`](distribution@cb121c3) Set Content-Type header in registry client ReadFrom * [release/2.8] update to go1.20.8 ([distribution#4056](distribution#4056)) * [`3c6f7788`](distribution@3c6f778) update to go1.20.8 * [`31f5cd48`](distribution@31f5cd4) Handle rand deprecations in go 1.20 * [`29b8ba0b`](distribution@29b8ba0) Update to go 1.20 * [`3316b198`](distribution@3316b19) Update to golang 1.19.10 * [`444d053e`](distribution@444d053) update golangci-lint to v1.52 * [`b800af44`](distribution@b800af4) ignore SA1019: ac.(*accessController).rootCerts.Subjects has been deprecated * [`0a98a00d`](distribution@0a98a00) Ignore SA1019: SplitHostname is deprecated. * [release/2.8 backport] Dont parse errors as JSON unless Content-Type is set to JSON ([distribution#4054](distribution#4054)) * [`2ec0471b`](distribution@2ec0471) Dont parse errors as JSON unless Content-Type is set to JSON * [release/2.8 backport] reference: replace deprecated function SplitHostname ([distribution#4032](distribution#4032)) * [`b57133cc`](distribution@b57133c) referene: fix formatting of "deprecated" comment. * [`2c4bf1a6`](distribution@2c4bf1a) replace deprecated function * [release/2.8 backport] Enable Go build tags ([distribution#4009](distribution#4009)) * [`110cb753`](distribution@110cb75) Enable build tags in 2.8 * [`2d62a402`](distribution@2d62a40) s3: add interface assertion * [`2548973b`](distribution@2548973) Enable Go build tags * Pass `BUILDTAGS` argument to `go build` ([distribution#3926](distribution#3926)) * [`ab7178cc`](distribution@ab7178c) Pass BUILDTAGS argument to go build </p> </details> * **github.com/distribution/reference** 49c28499d219 **_new_** * **github.com/opencontainers/go-digest** a6d0ee40d420 -> ea51bea511f7 Previous release can be found at [v2.8.2](https://github.com/distribution/distribution/releases/tag/v2.8.2)
quotengrote
pushed a commit
to quotengrote/ansible
that referenced
this pull request
Jan 26, 2024
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [registry](https://github.com/distribution/distribution) | patch | `2.8.2` -> `2.8.3` | --- > ⚠ **Warning** > > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>distribution/distribution (registry)</summary> ### [`v2.8.3`](https://github.com/distribution/distribution/releases/tag/v2.8.3) [Compare Source](distribution/distribution@v2.8.2...v2.8.3) #### What's Changed - Pass `BUILDTAGS` argument to `go build` by [@​marcusirgens](https://github.com/marcusirgens) in distribution/distribution#3926 - Enable Go build tags by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4009 - `reference`: replace deprecated function `SplitHostname` by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4032 - Dont parse errors as JSON unless Content-Type is set to JSON by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4054 - update to go 1.20.8 by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4056 - Set `Content-Type` header in registry client `ReadFrom` by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4053 - deprecate reference package, migrate to github.com/distribution/reference by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4063 - `digestset`: deprecate package in favor of `go-digest/digestset` by [@​thaJeztah](https://github.com/thaJeztah) in distribution/distribution#4064 - Do not close HTTP request body in HTTP handler by [@​milosgajdos](https://github.com/milosgajdos) in distribution/distribution#4068 - Add v2.8.3 release notes by [@​milosgajdos](https://github.com/milosgajdos) in distribution/distribution#4088 #### New Contributors - [@​marcusirgens](https://github.com/marcusirgens) made their first contribution in distribution/distribution#3926 **Full Changelog**: distribution/distribution@v2.8.2...v2.8.3 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xNTIuMSIsInVwZGF0ZWRJblZlciI6IjM3LjE1Mi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIn0=--> Reviewed-on: https://git.mgrote.net/mg/homeserver/pulls/667 Co-authored-by: Renovate Bot <renovate@mgrote.net> Co-committed-by: Renovate Bot <renovate@mgrote.net>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
(partial) cherry-picks of;