chore(deps): update all dependencies #131

renovate · 2023-10-12T13:59:09Z

This PR contains the following updates:

Package	Update	Change
anchore/grype	minor	`0.70.0` -> `0.72.0`
anchore/syft	minor	`0.93.0` -> `0.94.0`
awscli	patch	`2.13.25` -> `2.13.28`
defenseunicorns/build-harness	patch	`1.13.0` -> `1.13.1`
defenseunicorns/zarf	patch	`0.30.0` -> `0.30.1`
flux2	patch	`2.1.1` -> `2.1.2`
golangci-lint	minor	`1.54.2` -> `1.55.0`
helm	patch	`3.13.0` -> `3.13.1`
https://github.com/bridgecrewio/checkov.git	patch	`2.5.7` -> `2.5.15`
kubectl	patch	`1.28.2` -> `1.28.3`
opentofu/opentofu	patch	`1.6.0-alpha2` -> `1.6.0-alpha3`
pre-commit	minor	`3.4.0` -> `3.5.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

anchore/grype (anchore/grype)

`v0.72.0`

Compare Source

Added Features

Add --ignore-states flag for ignoring findings with specific fix states [#1473 @jhebden-gl]
Implement checksum & artifact signing [#1513 #1535 @hibare]

Bug Fixes

Report errors to stderr not stdout [#1561 @wagoodman]
grype v0.71.0 stopped showing vulnerabilities for Go stdlib [#1562 #1565 @wagoodman]
SARIF output not compatible with GitHub [#1518 #1563 @spiffcs]

(Full Changelog)

`v0.71.0`

Compare Source

Added Features

use ghsa to improve matching for cpes [#811 #1412 @westonsteimel]

(Full Changelog)

anchore/syft (anchore/syft)

`v0.94.0`

Compare Source

Added Features

Add additional license filenames [#2227 @coheigea]
Parse donet dependency trees [#2143 @noqcks]
Find license by embedded license text [#2147 #2213 @coheigea]
Add support for dpkg dependency relationships [#2040 #2212 @wagoodman]

Bug Fixes

Report errors to stderr not stdout [#2232 @wagoodman]
Python egg packages are not parsed for SBOM [#1761 #2239 @spiffcs]
Java archive is listed twice [#2130 #2220 @wagoodman]
Java archives not from Maven [#2217 #2220 @wagoodman]
Remove internal.StringSet [#2209 #2219 @wagoodman]
Invalid interface conversion in Swift cataloger [#2225 #2226 @wagoodman]

(Full Changelog)

aws/aws-cli (awscli)

defenseunicorns/build-harness (defenseunicorns/build-harness)

`v1.13.1`

Compare Source

Miscellaneous Chores

deps: update all dependencies (#125) (822b609)

defenseunicorns/zarf (defenseunicorns/zarf)

`v0.30.1`

Compare Source

What's Changed

Features

Support mirroring non-image artifacts (i.e. Cosign signatures, OCI Helm Charts, etc) under the images key by @mjnagel in https://github.com/defenseunicorns/zarf/pull/2027
Improve support for finding images that are used in operators with zarf prepare find-images by @mjnagel in https://github.com/defenseunicorns/zarf/pull/2027
Automatically discover cosign signatures / attestations for discovered images in zarf prepare find-images by @mjnagel in https://github.com/defenseunicorns/zarf/pull/2027
Introduce Agent TLS secret rolling with zarf tools update-creds agent by @Racer159 in https://github.com/defenseunicorns/zarf/pull/2065

Fixes

Properly allow namespaces to be empty when using zarf tools wait-for by @Racer159 in https://github.com/defenseunicorns/zarf/pull/2055
Fix package metadata templating when using zarf package create with -o to an OCI remote by @corang in https://github.com/defenseunicorns/zarf/pull/2067
Properly return a nil on error during a cluster creation call to prevent panics by @Racer159 in https://github.com/defenseunicorns/zarf/pull/2068
Streamline the creation of packages by removing the max package size prompt by @Racer159 in https://github.com/defenseunicorns/zarf/pull/2071

Docs

Update warning to caution admonition within the Pepr Webhooks example by @Racer159 in https://github.com/defenseunicorns/zarf/pull/2053
Improve documentation for package sources and for the use of --max-package-size by @Racer159 in https://github.com/defenseunicorns/zarf/pull/2071

Development

Add the cleanup files action to the push stage of release workflow by @Racer159 in https://github.com/defenseunicorns/zarf/pull/2073

Full Changelog: zarf-dev/zarf@v0.30.0...v0.30.1

fluxcd/flux2 (flux2)

`v2.1.2`

Compare Source

Highlights

Flux v2.1.2 is a patch release which comes with various fixes. Users are encouraged to upgrade for the best experience.

Fixes

Ensures faster recovery of Kustomization and HelmRelease resources when the source-controller has restarted and is working on restoring the storage.
Prevent source-controller from failing to reconcile OCIRepositories when artifacts contain symlinks.
Addresses issue with helm-controller miss-labeling Custom Resource Definitions.
Detect immutable field errors in Google Cloud resources managed by Flux Kustomizations.
Better error reporting for flux bootstrap when the owner doesn't match the identity associated with the given token.
Allow flux pull artifact to fetch OCI artifacts produced by other tools.

Components changelog

source-controller v1.1.2
kustomize-controller v1.1.1
helm-controller v0.36.2

CLI Changelog

PR #4324 - @somtochiama - bootstrap: Fix error msg when the Git token doesn't match the repo owner
PR #4323 - @stefanprodan - e2e: Update Go dependencies
PR #4313 - @fluxcdbot - Update toolkit components
PR #4296 - @Skarlso - fix: only wait for changeset if the result is not empty
PR #4285 - @matheuscscp - Add badge for SLSA Level 3
PR #4284 - @errordeveloper - Make flux pull work for OCI artifacts produced by other tools

golangci/golangci-lint (golangci-lint)

`v1.55.0`

Compare Source

Changelog

4b188db Add "inamedparam": checks for interface method with unnamed params (#3793)
2d5d29f Add testifylint linter (#4103)
3c34799 Add a pre-commit hook to check all files (#4046)
de1c391 Add perfsprint linter (#3714)
8c178d3 add protogetter linter (#4069)
c65ab4b build(deps): bump actions/checkout from 3 to 4 (#4065)
b74ffbb build(deps): bump docker/build-push-action from 4 to 5 (#4094)
b974c30 build(deps): bump docker/setup-buildx-action from 2 to 3 (#4093)
47d7785 build(deps): bump docker/setup-qemu-action from 2 to 3 (#4095)
cf93cf5 build(deps): bump github.com/4meepo/tagalign from 1.3.2 to 1.3.3 (#4143)
95edd30 build(deps): bump github.com/Abirdcfly/dupword from 0.0.12 to 0.0.13 (#4104)
5b40213 build(deps): bump github.com/breml/bidichk from 0.2.4 to 0.2.6 (#4044)
c6eae6c build(deps): bump github.com/breml/bidichk from 0.2.6 to 0.2.7 (#4101)
f4b0ca7 build(deps): bump github.com/breml/errchkjson from 0.3.1 to 0.3.5 (#4042)
c9956e8 build(deps): bump github.com/breml/errchkjson from 0.3.5 to 0.3.6 (#4102)
64e382b build(deps): bump github.com/butuzov/ireturn from 0.2.0 to 0.2.1 (#4142)
cc02271 build(deps): bump github.com/daixiang0/gci from 0.11.0 to 0.11.1 (#4068)
615a52b build(deps): bump github.com/daixiang0/gci from 0.11.1 to 0.11.2 (#4090)
0605100 build(deps): bump github.com/ghostiam/protogetter from 0.2.2 to 0.2.3 (#4130)
f18d712 build(deps): bump github.com/golangci/revgrep from 745bb2f to v0.5.0 (#4064)
a69976a build(deps): bump github.com/jgautheron/goconst from 1.5.1 to 1.6.0 (#4055)
663d002 build(deps): bump github.com/mgechev/revive from 1.3.2 to 1.3.3 (#4043)
eeb2088 build(deps): bump github.com/mgechev/revive from 1.3.3 to 1.3.4 (#4087)
0e82ef5 build(deps): bump github.com/nunnatsa/ginkgolinter from 0.13.5 to 0.14.0 (#4117)
452410c build(deps): bump github.com/polyfloyd/go-errorlint from 1.4.4 to 1.4.5 (#4078)
b673fb7 build(deps): bump github.com/ryanrolds/sqlclosecheck from 0.4.0 to 0.5.1 (#4071)
823f02d build(deps): bump github.com/securego/gosec/v2 from 2.17.0 to 2.18.0 (#4120)
e96af3a build(deps): bump github.com/securego/gosec/v2 from 2.18.0 to 2.18.1 (#4131)
2858394 build(deps): bump github.com/shirou/gopsutil/v3 from 3.23.7 to 3.23.8 (#4063)
1af49e3 build(deps): bump github.com/shirou/gopsutil/v3 from 3.23.8 to 3.23.9 (#4111)
22c6434 build(deps): bump github.com/tetafro/godot from 1.4.14 to 1.4.15 (#4077)
0946f2c build(deps): bump github.com/uudashr/gocognit from 1.0.7 to 1.1.1 (#4129)
904cec8 build(deps): bump github.com/uudashr/gocognit from 1.1.0 to 1.1.2 (#4145)
ffb9608 build(deps): bump github.com/uudashr/gocognit from 1.1.1 to 1.1.0 (#4144)
865b93a build(deps): bump github.com/xen0n/gosmopolitan from 1.2.1 to 1.2.2 (#4070)
4b72aa5 build(deps): bump gitlab.com/bosi/decorder from 0.4.0 to 0.4.1 (#4056)
4b83e50 build(deps): bump golang.org/x/net from 0.10.0 to 0.17.0 in /tools (#4124)
6cd1bfd build(deps): bump golang.org/x/net from 0.16.0 to 0.17.0 in /scripts/gen_github_action_config (#4125)
efb52af build(deps): bump golang.org/x/oauth2 from 0.11.0 to 0.12.0 in /scripts/gen_github_action_config (#4079)
2b73b3a build(deps): bump golang.org/x/oauth2 from 0.12.0 to 0.13.0 in /scripts/gen_github_action_config (#4122)
28d88a1 build(deps): bump golang.org/x/tools from 0.12.0 to 0.13.0 (#4066)
dd58dd5 build(deps): bump golang.org/x/tools from 0.13.0 to 0.14.0 (#4119)
75b6a08 build(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 (#4036)
fd06dca build(deps): bump goreleaser/goreleaser-action from 4 to 5 (#4080)
41bfce9 build(deps): bump honnef.co/go/tools from 0.4.5 to 0.4.6 (#4083)
69d6cc9 feat: add gochecksumtype linter (#3671)
39c5fd1 feat: add sloglint linter (#4133)
3d8ae00 feat: update gofmt and goimports (#4115)
4254fad fix: update gofmt (#4141)
6491317 govet: add appends analyzer (#4127)
bce3dfd unused: support passing in options (#4086)

helm/helm (helm)

`v3.13.1`: Helm v3.13.1

Compare Source

Helm v3.13.1 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

Join the discussion in Kubernetes Slack:
- for questions and just to hang out
- for discussing PRs, code, and bugs
Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.1. The common platform binaries are here:

MacOS amd64 (checksum / e207e009b931162b0383b463c333a2792355200e91dbcf167c97c150e9f5fedb)
MacOS arm64 (checksum / 46596d6d2d9aa545eb74f40684858fac0841df373ca760af1259d3493161d8c9)
Linux amd64 (checksum / 98c363564d00afd0cc3088e8f830f2a0eeb5f28755b3d8c48df89866374a1ed0)
Linux arm (checksum / a9c188c1a79d2eb1721aece7c4e7cfcd56fa76d1e37bd7c9c05d3969bb0499b4)
Linux arm64 (checksum / 8c4a0777218b266a7b977394aaf0e9cef30ed2df6e742d683e523d75508d6efe)
Linux i386 (checksum / 384e1f97b6dafad62ccdd856e9453b68143e4dbdc7b9cf9a2a2f79c2aa7c2cc9)
Linux ppc64le (checksum / f0d4ae95b4db25d03ced987e30d424564bd4727af6a4a0b7fca41f14203306fb)
Linux s390x (checksum / b657b72b34f568527093dede148ae72fcbc1f2e67d3fd6f2ffa1095637fbddb6)
Windows amd64 (checksum / 6e16fbc5e50a5841be2dc725e790234f09aa2a5ebe289493c90f65ecae7b156f)

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

3.13.2 is a patch release and will be on November 08, 2023.
3.14.0 is the next feature release and be on January 17, 2024.

Changelog

Fixing precedence issue with the import of values. 3547a4b (Matt Farina)
Add missing with clause to release gh action 6f9ad87 (Ian Zink)
FIX Default ServiceAccount yaml bae7b32 (Lars Zimmermann)
fix(registry): unswallow error 06e4fb1 (Hidde Beydals)
remove useless print during prepareUpgrade 0e7ec78 (b4nks)
fix(registry): address anonymous pull issue 0ac7894 (Hidde Beydals)
Fix missing run statement on release action 0901269 (Ian Zink)
Write latest version to get.helm.sh bucket 6101393 (Ian Zink)
chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 c99a8ac (dependabot[bot])
Increased release information key name max length. 52a029d (abrarcv170)
chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 ff8e61d (dependabot[bot])

bridgecrewio/checkov (https://github.com/bridgecrewio/checkov.git)

`v2.5.15`

Compare Source

`v2.5.14`

Compare Source

`v2.5.13`

Compare Source

`v2.5.12`

Compare Source

`v2.5.11`

Compare Source

`v2.5.10`

Compare Source

`v2.5.9`

Compare Source

`v2.5.8`

Compare Source

Feature

general: Remove code upload for on-prem integrations - #5624

kubernetes/kubernetes (kubectl)

`v1.28.3`: Kubernetes v1.28.3

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

opentofu/opentofu (opentofu/opentofu)

`v1.6.0-alpha3`

Compare Source

Hey!

Since the last alpha release, there's been multiple bug fixes for

crashes caused by sensitive arguments to the import block;
KMS key aliases not being supported;
the new global provider schema cache not being used properly;
the inability to disable state snapshots when the x-terraform-snapshot-interval header is absent.

Additionally, there's been many improvements to the release process, more cleanup of the code, and removals of legacy TFC/TFE mentions in stdoud-printed text. We're extremely grateful to all external contributors for their contributions!

You can find more details in the updated changelog!

Full Diff: opentofu/opentofu@v1.6.0-alpha2...v1.6.0-alpha3

pre-commit/pre-commit (pre-commit)

`v3.5.0`

Compare Source

==================

Features

Improve performance of check-hooks-apply and check-useless-excludes.
- #2998 PR by @mxr.
- #2935 issue by @mxr.

Fixes

Use time.monotonic() for more accurate hook timing.
- #3024 PR by @adamchainz.

Migrating

Require npm 6.x+ for language: node hooks.
- #2996 PR by @RoelAdriaans.
- #1983 issue by @henryiii.

Configuration

📅 Schedule: Branch creation - "after 9am and before 5pm every weekday" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

renovate bot requested a review from a team as a code owner October 12, 2023 13:59

renovate bot added the renovate This PR was created by RenovateBot label Oct 12, 2023

renovate bot force-pushed the renovate/all branch 11 times, most recently from dda4a11 to f8c7a16 Compare October 19, 2023 13:25

renovate bot force-pushed the renovate/all branch 3 times, most recently from 624a7cd to 3dd3be5 Compare October 20, 2023 18:00

chore(deps): update all dependencies

4e5a924

renovate bot force-pushed the renovate/all branch from 3dd3be5 to 4e5a924 Compare October 20, 2023 19:34

RothAndrew approved these changes Oct 20, 2023

View reviewed changes

RothAndrew added this pull request to the merge queue Oct 20, 2023

Merged via the queue into main with commit 3de15ff Oct 20, 2023
2 checks passed

RothAndrew deleted the renovate/all branch October 20, 2023 20:41

narwhal-bot bot mentioned this pull request Oct 20, 2023

chore(main): release 1.13.2 #130

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update all dependencies #131

chore(deps): update all dependencies #131

renovate bot commented Oct 12, 2023 •

edited

Loading

chore(deps): update all dependencies #131

chore(deps): update all dependencies #131

Conversation

renovate bot commented Oct 12, 2023 • edited Loading

Release Notes

Added Features

Bug Fixes

Added Features

Added Features

Bug Fixes

Miscellaneous Chores

What's Changed

Features

Fixes

Docs

Development

Highlights

Fixes

Components changelog

CLI Changelog

Changelog

v3.13.1: Helm v3.13.1

Installation and Upgrading

What's Next

Changelog

Feature

v1.28.3: Kubernetes v1.28.3

Features

Fixes

Migrating

Configuration

renovate bot commented Oct 12, 2023 •

edited

Loading

`v3.13.1`: Helm v3.13.1

`v1.28.3`: Kubernetes v1.28.3