Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build(deps): bump the go_modules group across 1 directory with 4 updates #410

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

build(deps): bump the go_modules group across 1 directory with 4 updates #410

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 25, 2024 •
edited

Bumps the go_modules group with 4 updates in the / directory: golang.org/x/net, github.com/opencontainers/runc, go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful and go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc.

Updates golang.org/x/net from 0.19.0 to 0.23.0

Commits
  • c48da13 http2: fix TestServerContinuationFlood flakes
  • 762b58d http2: fix tipos in comment
  • ba87210 http2: close connections when receiving too many headers
  • ebc8168 all: fix some typos
  • 3678185 http2: make TestCanonicalHeaderCacheGrowth faster
  • 448c44f http2: remove clientTester
  • c7877ac http2: convert the remaining clientTester tests to testClientConn
  • d8870b0 http2: use synthetic time in TestIdleConnTimeout
  • d73acff http2: only set up deadline when Server.IdleTimeout is positive
  • 89f602b http2: validate client/outgoing trailers
  • Additional commits viewable in compare view

Updates github.com/opencontainers/runc from 1.1.10 to 1.1.12

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc 1.1.12 -- "Now you're thinking with Portals™!"

This is the twelfth patch release in the 1.1.z release branch of runc. It fixes a high-severity container breakout vulnerability involving leaked file descriptors, and users are strongly encouraged to update as soon as possible.

  • Fix CVE-2024-21626, a container breakout attack that took advantage of a file descriptor that was leaked internally within runc (but never leaked to the container process).

    In addition to fixing the leak, several strict hardening measures were added to ensure that future internal leaks could not be used to break out in this manner again.

    Based on our research, while no other container runtime had a similar leak, none had any of the hardening steps we've introduced (and some runtimes would not check for any file descriptors that a calling process may have leaked to them, allowing for container breakouts due to basic user error).

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages or download them from the authoritative upstream sources, especially since these libraries are related to the security of your containers.

Thanks to all of the contributors who made this release possible:

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.1.12] - 2024-01-31

Now you're thinking with Portals™!

Security

  • Fix CVE-2024-21626, a container breakout attack that took advantage of a file descriptor that was leaked internally within runc (but never leaked to the container process). In addition to fixing the leak, several strict hardening measures were added to ensure that future internal leaks could not be used to break out in this manner again. Based on our research, while no other container runtime had a similar leak, none had any of the hardening steps we've introduced (and some runtimes would not check for any file descriptors that a calling process may have leaked to them, allowing for container breakouts due to basic user error).

[1.1.11] - 2024-01-01

Happy New Year!

Fixed

Changed

  • Support memory.peak and memory.swap.peak in cgroups v2. Add swapOnlyUsage in MemoryStats. This field reports swap-only usage. For cgroupv1, Usage and Failcnt are set by subtracting memory usage from memory+swap usage. For cgroupv2, Usage, Limit, and MaxUsage are set. (#4000, #4010, #4131)
  • build(deps): bump github.com/cyphar/filepath-securejoin. (#4140)
Commits
  • 51d5e94 VERSION: release 1.1.12
  • 2a4ed3e merge 1.1-GHSA-xr7r-f8xq-vfvv into release-1.1
  • e9665f4 init: don't special-case logrus fds
  • 683ad2f libcontainer: mark all non-stdio fds O_CLOEXEC before spawning init
  • b6633f4 cgroup: plug leaks of /sys/fs/cgroup handle
  • 284ba30 init: close internal fds before execve
  • fbe3eed setns init: do explicit lookup of execve argument early
  • 0994249 init: verify after chdir that cwd is inside the container
  • 506552a Fix File to Close
  • 099ff69 merge #4177 into opencontainers/runc:release-1.1
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful from 0.42.0 to 0.44.0

Release notes

Sourced from go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful's releases.

Release v1.26.0/v0.51.0/v0.20.0/v0.6.0/v0.1.0

Added

  • NewSDK in go.opentelemetry.io/contrib/config now returns a configured SDK with a valid MeterProvider. (#4804)

Changed

  • Change the scope name for the prometheus bridge to go.opentelemetry.io/contrib/bridges/prometheus to match the package. (#5396)

Fixed

  • Fix bug where an empty exemplar was added to counters in go.opentelemetry.io/contrib/bridges/prometheus. (#5395)
  • Fix bug where the last histogram bucket was missing in go.opentelemetry.io/contrib/bridges/prometheus. (#5395)

Full Changelog: open-telemetry/opentelemetry-go-contrib@v1.25.0...v1.26.0

Release v1.25.0/v0.50.0/v0.19.0/v0.5.0/v0.0.1

Added

  • Implemented setting the cloud.resource_id resource attribute in go.opentelemetry.io/detectors/aws/ecs based on the ECS Metadata v4 endpoint. (#5091)
  • The go.opentelemetry.io/contrib/bridges/otelslog module. This module provides an OpenTelemetry logging bridge for "log/slog". (#5335)

Fixed

  • Update all dependencies to address [GO-2024-2687]. (#5359)

Removed

Full Changelog: open-telemetry/opentelemetry-go-contrib@v1.24.0...v1.25.0

Release v1.24.0/v0.49.0/v0.18.0/v0.4.0

This release is the last to support Go 1.20. The next release will require at least [Go 1.21].

Added

  • Support [Go 1.22]. (#5082)
  • Add support for Summary metrics to go.opentelemetry.io/contrib/bridges/prometheus. (#5089)
  • Add support for Exponential (native) Histograms in go.opentelemetry.io/contrib/bridges/prometheus. (#5093)

Removed

  • The deprecated RequestCount constant in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is removed. (#4894)
  • The deprecated RequestContentLength constant in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is removed. (#4894)
  • The deprecated ResponseContentLength constant in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is removed. (#4894)
  • The deprecated ServerLatency constant in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is removed. (#4894)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful's changelog.

[1.19.0/0.44.0/0.13.0] - 2023-09-12

Added

  • Add gcp.gce.instance.name and gcp.gce.instance.hostname resource attributes to go.opentelemetry.io/contrib/detectors/gcp. (#4263)

Changed

  • The semantic conventions used by go.opentelemetry.io/contrib/detectors/aws/ec2 have been upgraded to v1.21.0. (#4265)
  • The semantic conventions used by go.opentelemetry.io/contrib/detectors/aws/ecs have been upgraded to v1.21.0. (#4265)
  • The semantic conventions used by go.opentelemetry.io/contrib/detectors/aws/eks have been upgraded to v1.21.0. (#4265)
  • The semantic conventions used by go.opentelemetry.io/contrib/detectors/aws/lambda have been upgraded to v1.21.0. (#4265)
  • The semantic conventions used by go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda have been upgraded to v1.21.0. (#4265)
    • The faas.execution attribute is now faas.invocation_id.
    • The faas.id attribute is now aws.lambda.invoked_arn.
  • The semantic conventions used by go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws have been upgraded to v1.21.0. (#4265)
  • The http.request.method attribute will only allow known HTTP methods from the metrics generated by go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#4277)

Removed

  • The high cardinality attributes net.sock.peer.addr, net.sock.peer.port, http.user_agent, enduser.id, and http.client_ip were removed from the metrics generated by go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#4277)
  • The deprecated go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego module is removed. (#4295)
  • The deprecated go.opentelemetry.io/contrib/instrumentation/github.com/go-kit/kit/otelkit module is removed. (#4295)
  • The deprecated go.opentelemetry.io/contrib/instrumentation/github.com/Shopify/sarama/otelsarama module is removed. (#4295)
  • The deprecated go.opentelemetry.io/contrib/instrumentation/github.com/bradfitz/gomemcache/memcache/otelmemcache module is removed. (#4295)
  • The deprecated go.opentelemetry.io/contrib/instrumentation/github.com/gocql/gocql/otelgocql module is removed. (#4295)

[1.18.0/0.43.0/0.12.0] - 2023-08-28

Added

  • Add NewMiddleware function in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#2964)
  • The go.opentelemetry.io/contrib/exporters/autoexport package to provide configuration of trace exporters with useful defaults and environment variable support. (#2753, #4100, #4130, #4132, #4134)
  • WithRouteTag in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp adds HTTP route attribute to metrics. (#615)
  • Add WithSpanOptions option in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#3768)
  • Add testing support for Go 1.21. (#4233)
  • Add WithFilter option to go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. (#4230)

Changed

  • Change interceptors in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to disable SENT/RECEIVED events. Use WithMessageEvents() to turn back on. (#3964)

Changed

  • go.opentelemetry.io/contrib/detectors/gcp: Detect faas.instance instead of faas.id, since faas.id is being removed. (#4198)

Fixed

  • AWS XRay Remote Sampling to cap quotaBalance to 1x quota in go.opentelemetry.io/contrib/samplers/aws/xray. (#3651, #3652)

... (truncated)

Commits

Updates go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.42.0 to 0.46.0

Release notes

Sourced from go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc's releases.

Release v1.26.0/v0.51.0/v0.20.0/v0.6.0/v0.1.0

Added

  • NewSDK in go.opentelemetry.io/contrib/config now returns a configured SDK with a valid MeterProvider. (#4804)

Changed

  • Change the scope name for the prometheus bridge to go.opentelemetry.io/contrib/bridges/prometheus to match the package. (#5396)

Fixed

  • Fix bug where an empty exemplar was added to counters in go.opentelemetry.io/contrib/bridges/prometheus. (#5395)
  • Fix bug where the last histogram bucket was missing in go.opentelemetry.io/contrib/bridges/prometheus. (#5395)

Full Changelog: open-telemetry/opentelemetry-go-contrib@v1.25.0...v1.26.0

Release v1.25.0/v0.50.0/v0.19.0/v0.5.0/v0.0.1

Added

  • Implemented setting the cloud.resource_id resource attribute in go.opentelemetry.io/detectors/aws/ecs based on the ECS Metadata v4 endpoint. (#5091)
  • The go.opentelemetry.io/contrib/bridges/otelslog module. This module provides an OpenTelemetry logging bridge for "log/slog". (#5335)

Fixed

  • Update all dependencies to address [GO-2024-2687]. (#5359)

Removed

Full Changelog: open-telemetry/opentelemetry-go-contrib@v1.24.0...v1.25.0

Release v1.24.0/v0.49.0/v0.18.0/v0.4.0

This release is the last to support Go 1.20. The next release will require at least [Go 1.21].

Added

  • Support [Go 1.22]. (#5082)
  • Add support for Summary metrics to go.opentelemetry.io/contrib/bridges/prometheus. (#5089)
  • Add support for Exponential (native) Histograms in go.opentelemetry.io/contrib/bridges/prometheus. (#5093)

Removed

  • The deprecated RequestCount constant in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is removed. (#4894)
  • The deprecated RequestContentLength constant in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is removed. (#4894)
  • The deprecated ResponseContentLength constant in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is removed. (#4894)
  • The deprecated ServerLatency constant in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is removed. (#4894)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc's changelog.

[1.21.0/0.46.0/0.15.0/0.1.0] - 2023-11-10

Added

  • Add "go.opentelemetry.io/contrib/samplers/jaegerremote".WithSamplingStrategyFetcher which sets custom fetcher implementation. (#4045)
  • Add "go.opentelemetry.io/contrib/config" package that includes configuration models generated via go-jsonschema. (#4376)
  • Add NewSDK function to "go.opentelemetry.io/contrib/config". The initial implementation only returns noop providers. (#4414)
  • Add metrics support (No-op, OTLP and Prometheus) to go.opentelemetry.io/contrib/exporters/autoexport. (#4229, #4479)
  • Add support for console span exporter and metrics exporter in go.opentelemetry.io/contrib/exporters/autoexport. (#4486)
  • Set unit and description on all instruments in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#4500)
  • Add metric support for grpc.StatsHandler in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#4356)
  • Expose the name of the scopes in all instrumentation libraries as ScopeName. (#4448)

Changed

  • Dropped compatibility testing for [Go 1.19]. The project no longer guarantees support for this version of Go. (#4352)
  • Upgrade dependencies of OpenTelemetry Go to use the new v1.20.0/v0.43.0 release. (#4546)
  • In go.opentelemetry.io/contrib/exporters/autoexport, Option was renamed to SpanOption. The old name is deprecated but continues to be supported as an alias. (#4229)

Deprecated

  • The interceptors (UnaryClientInterceptor, StreamClientInterceptor, UnaryServerInterceptor, StreamServerInterceptor, WithInterceptorFilter) are deprecated. Use stats handlers (NewClientHandler, NewServerHandler) instead. (#4534)

Fixed

  • The go.opentelemetry.io/contrib/samplers/jaegerremote sampler does not panic when the default HTTP round-tripper (http.DefaultTransport) is not *http.Transport. (#4045)
  • The UnaryServerInterceptor in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc now sets gRPC status code correctly for the rpc.server.duration metric. (#4481)
  • The NewClientHandler, NewServerHandler in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc now honor otelgrpc.WithMessageEvents options. (#4536)
  • The net.sock.peer.* and net.peer.* high cardinality attributes are removed from the metrics generated by go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#4322)

[1.20.0/0.45.0/0.14.0] - 2023-09-28

Added

  • Set the description for the rpc.server.duration metric in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#4302)
  • Add NewServerHandler and NewClientHandler that return a grpc.StatsHandler used for gRPC instrumentation in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#3002)
  • Add new Prometheus bridge module in go.opentelemetry.io/contrib/bridges/prometheus. (#4227)

Changed

  • Upgrade dependencies of OpenTelemetry Go to use the new v1.19.0/v0.42.0/v0.0.7 release.
  • Use grpc.StatsHandler for gRPC instrumentation in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/example. (#4325)

[1.19.0/0.44.0/0.13.0] - 2023-09-12

Added

  • Add gcp.gce.instance.name and gcp.gce.instance.hostname resource attributes to go.opentelemetry.io/contrib/detectors/gcp. (#4263)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the go_modules group across 1 directory with 4 updates
3941a08 
Bumps the go_modules group with 4 updates in the / directory: [golang.org/x/net](https://github.com/golang/net), [github.com/opencontainers/runc](https://github.com/opencontainers/runc), [go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful](https://github.com/open-telemetry/opentelemetry-go-contrib) and [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib).


Updates `golang.org/x/net` from 0.19.0 to 0.23.0
- [Commits](golang/net@v0.19.0...v0.23.0)

Updates `github.com/opencontainers/runc` from 1.1.10 to 1.1.12
- [Release notes](https://github.com/opencontainers/runc/releases)
- [Changelog](https://github.com/opencontainers/runc/blob/main/CHANGELOG.md)
- [Commits](opencontainers/runc@v1.1.10...v1.1.12)

Updates `go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful` from 0.42.0 to 0.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.42.0...zpages/v0.44.0)

Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.42.0 to 0.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.42.0...zpages/v0.46.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/opencontainers/runc
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Apr 25, 2024
@ks-ci-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
To complete the pull request process, please assign renyunkang after the PR has been reviewed.
You can assign the PR to them by writing /assign @renyunkang in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

1 similar comment
@ks-ci-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
To complete the pull request process, please assign renyunkang after the PR has been reviewed.
You can assign the PR to them by writing /assign @renyunkang in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ks-ci-bot ks-ci-bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Apr 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@ks-ci-bot