Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update all dependencies 12/19/2023 #1044

Closed
wants to merge 1 commit into from

Conversation

nlacey
Copy link

@nlacey nlacey commented Dec 19, 2023

This should fix all of your golang.org/x/crypto security issues.

you can reproduce this PR with following commands using tcsh
cd $GOPATH/github.com/lestrrat-go/jwx
setenv HEAD $PWD

foreach dir (find . -type d)
cd $HEAD
cd $dir
go get -u ./...
go mod tidy
end

you'll get errors for folder that don't have go.mod files. but when you are done, all the go.mod/go.sum files will be updated

@nlacey
Copy link
Author

nlacey commented Dec 19, 2023

this should combine/close PR's 1035-1042

Copy link

codecov bot commented Dec 19, 2023

Codecov Report

Attention: 4 lines in your changes are missing coverage. Please review.

Comparison is base (0a15b4d) 72.00% compared to head (6bd2329) 72.27%.
Report is 16 commits behind head on develop/v2.

Files Patch % Lines
jwe/jwe.go 91.17% 2 Missing and 1 partial ⚠️
jwe/options_gen.go 88.88% 1 Missing ⚠️
Additional details and impacted files
@@              Coverage Diff               @@
##           develop/v2    #1044      +/-   ##
==============================================
+ Coverage       72.00%   72.27%   +0.27%     
==============================================
  Files              93       93              
  Lines           13795    13844      +49     
==============================================
+ Hits             9933    10006      +73     
+ Misses           3044     3021      -23     
+ Partials          818      817       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@lestrrat
Copy link
Collaborator

Thanks. And sorry, this bit isn't as streamlined as it should be: you need to run a bazel //:gazell-update-repos command after upgrading mods. Thankfully, I did put checks for it! :D

I'll do that myself

lestrrat added a commit that referenced this pull request Dec 19, 2023
* update all dependencies 12/19/2023

* Run gazelle-update-repos

---------

Co-authored-by: Nathan Lacey <nlacey@novetta.com>
@lestrrat
Copy link
Collaborator

merged via #1045

@lestrrat lestrrat closed this Dec 19, 2023
lestrrat added a commit that referenced this pull request Jan 9, 2024
* Bump golang.org/x/crypto from 0.14.0 to 0.15.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.15.0.
- [Commits](golang/crypto@v0.14.0...v0.15.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Run gazelle-update-repos

* Add jwe.WithCEK (#1011)

* Add jwe.WithCEK

* Allow using a static CEK via EncryptStatic

* appease linter

* Update go.sum

* Docs

* Update generated options

* Add test

* clarify when jwk.Set.RemoveKey can return error (#1015)

* Remove signer instance upon call to jws.UnregisterSigner (#1017)

* Delete signer instance upon call to jws.UnregisterSigner

* Update Changes

* Tweak documentation (#1018)

* Bump golang.org/x/crypto from 0.15.0 to 0.16.0 (#1020)

* Bump golang.org/x/crypto from 0.15.0 to 0.16.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.15.0 to 0.16.0.
- [Commits](golang/crypto@v0.15.0...v0.16.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Run bazel and tidy

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com>

* Merge pull request from GHSA-7f9x-gw85-8grf

* Update Changes

* Appease linter

* fix deps.bzl

* Bump actions/setup-go from 4 to 5 (#1027)

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 5.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump actions/stale from 8 to 9 (#1029)

Bumps [actions/stale](https://github.com/actions/stale) from 8 to 9.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@v8...v9)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Merge #1044 (#1045)

* update all dependencies 12/19/2023

* Run gazelle-update-repos

---------

Co-authored-by: Nathan Lacey <nlacey@novetta.com>

* Update go version in go.mod to go1.18, which matches CI (#1046)

* Bump github/codeql-action from 2 to 3 (#1031)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v2...v3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add jws.IsVerificationError (#1049)

* Add jws.IsVerificationError

* tweak document

* Merge pull request from GHSA-pvcr-v8j8-j5q3

* Add tests for empty protected headers

* check for sig.protected == nil

* Add one more case for missing protected headers in compact form

* Update Changes

* JWS: Check for sig.protected == nil on non-flattened input

---------

Co-authored-by: Fredrik Strupe <fredrik@strupe.net>

* Update Changes

* fix typo

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Shang Jian Ding <sding3@ncsu.edu>
Co-authored-by: Nathan Lacey <nlacey@novetta.com>
Co-authored-by: Fredrik Strupe <fredrik@strupe.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants