Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump github.com/pires/go-proxyproto from 0.2.0 to 0.5.0 #56

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Mar 8, 2021

Bumps github.com/pires/go-proxyproto from 0.2.0 to 0.5.0.

Release notes

Sourced from github.com/pires/go-proxyproto's releases.

v0.5.0

Bugfixes

The two bugs addressed below are considered serious security issues that can lead to DoS. I cannot express how thankful I am for @​isedev for sharing the problem and the solution <3

  • v1: enforce header maximum size of 107 bytes to avoid unbounded memory consumption (#71)
  • v1: sender must always ensure that the header is sent at once to avoid slow loris attack (#71)

Improvements

  • Add PP2_TYPE_UNIQUE_ID (#67) thanks to @​TimWolla
  • Add ReadFrom/WriteTo to increase performance when proxying wrapped connections using io.Copy (#68) thanks to @​databus23

v0.4.2

Bugfixes

Documentation

  • Fix LICENSE (#66)

v0.4.1

Bugfixes

v0.4.0

Announcement

First, the master branch has been renamed to main. Assuming your local copy has this repo as remote origin, execute the following commands:

git branch -m master main
git fetch origin

Optionally, if you're tracking this instead of a fork:

git branch -u origin/main main

Breaking changes

  • Replaced v1 throwing ErrCantReadProtocolVersionAndCommand with:
    • ErrLineMustEndWithCrlf when the issue is the line doesn't end with \r\n, which is required as per spec, and
    • ErrCantReadAddressFamilyAndProtocol when inet family and transport protocol are not TCP4, TCP6 or UNKNOWN, as per spec. Also, if not UNKNOWN, addresses information is required.

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto) from 0.2.0 to 0.5.0.
- [Release notes](https://github.com/pires/go-proxyproto/releases)
- [Commits](pires/go-proxyproto@v0.2.0...v0.5.0)

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 8, 2021
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Jul 12, 2021

Superseded by #84.

@dependabot dependabot bot closed this Jul 12, 2021
@dependabot dependabot bot deleted the dependabot/go_modules/github.com/pires/go-proxyproto-0.5.0 branch July 12, 2021 09:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
0 participants