Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat!(deps): bump golang.org/x/crypto from 0.13.0 to 0.16.0 #26

Merged
merged 3 commits into from
Dec 3, 2023
Merged

feat!(deps): bump golang.org/x/crypto from 0.13.0 to 0.16.0 #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
54917f6
build(deps): bump golang.org/x/crypto from 0.13.0 to 0.16.0
dependabot[bot] Nov 27, 2023
ecc8647
feat(.github/workflows/go): moves pipelines to a minimum of `go@1.18`…
matthewhartstonge Dec 3, 2023
f708397
docs(README): adds information on our versioning strategy in relation…
matthewhartstonge Dec 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 1 addition & 7 deletions .github/workflows/go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,16 +34,10 @@ jobs:
strategy:
matrix:
go-version:
- '1.11.4'
- '1.12'
- '1.13'
- '1.14'
- '1.15'
- '1.16'
- '1.17'
- '1.18'
- '1.19'
- '1.20'
- '1.21'
steps:
- name: Checkout Repository
uses: actions/checkout@v4
Expand Down
12 changes: 12 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,3 +101,15 @@ BenchmarkSecureZeroMemory1048576-8 52404 22442 ns/op 4
PASS
ok github.com/matthewhartstonge/argon2 18.481s
```

## Versioning Strategy

The API is stable and has been running in production for many years now, therefore won't be changing.

This library has a single dependency on `golang.org/x/crypto`. This means that as the version of Go is updated there, this library will roll up it's version to a new minor.
Any CVEs/security patches that come through via dependabot, without a resulting Go version update, will become a patch release.

For example:

- If a version of `/x/crypto` now requires `go@1.28`, `argon2` will go from `v1.0.0` -> `v1.1.0`.
- If `x/crypto` releases a version that resolves CVEs with no requirement to upgrade Go, then `argon2` will go from `v1.0.0` -> `v1.0.1`.
4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@ module github.com/matthewhartstonge/argon2

go 1.18

require golang.org/x/crypto v0.13.0
require golang.org/x/crypto v0.16.0

require golang.org/x/sys v0.12.0 // indirect
require golang.org/x/sys v0.15.0 // indirect
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
Loading