-
-
Notifications
You must be signed in to change notification settings - Fork 165
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
update all dependencies 12/19/2023 #1044
Conversation
this should combine/close PR's 1035-1042 |
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## develop/v2 #1044 +/- ##
==============================================
+ Coverage 72.00% 72.27% +0.27%
==============================================
Files 93 93
Lines 13795 13844 +49
==============================================
+ Hits 9933 10006 +73
+ Misses 3044 3021 -23
+ Partials 818 817 -1 ☔ View full report in Codecov by Sentry. |
Thanks. And sorry, this bit isn't as streamlined as it should be: you need to run a bazel //:gazell-update-repos command after upgrading mods. Thankfully, I did put checks for it! :D I'll do that myself |
merged via #1045 |
* Bump golang.org/x/crypto from 0.14.0 to 0.15.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.15.0. - [Commits](golang/crypto@v0.14.0...v0.15.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run gazelle-update-repos * Add jwe.WithCEK (#1011) * Add jwe.WithCEK * Allow using a static CEK via EncryptStatic * appease linter * Update go.sum * Docs * Update generated options * Add test * clarify when jwk.Set.RemoveKey can return error (#1015) * Remove signer instance upon call to jws.UnregisterSigner (#1017) * Delete signer instance upon call to jws.UnregisterSigner * Update Changes * Tweak documentation (#1018) * Bump golang.org/x/crypto from 0.15.0 to 0.16.0 (#1020) * Bump golang.org/x/crypto from 0.15.0 to 0.16.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.15.0 to 0.16.0. - [Commits](golang/crypto@v0.15.0...v0.16.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Run bazel and tidy --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Daisuke Maki <lestrrat+github@gmail.com> * Merge pull request from GHSA-7f9x-gw85-8grf * Update Changes * Appease linter * fix deps.bzl * Bump actions/setup-go from 4 to 5 (#1027) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 5. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v4...v5) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/stale from 8 to 9 (#1029) Bumps [actions/stale](https://github.com/actions/stale) from 8 to 9. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@v8...v9) --- updated-dependencies: - dependency-name: actions/stale dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Merge #1044 (#1045) * update all dependencies 12/19/2023 * Run gazelle-update-repos --------- Co-authored-by: Nathan Lacey <nlacey@novetta.com> * Update go version in go.mod to go1.18, which matches CI (#1046) * Bump github/codeql-action from 2 to 3 (#1031) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v2...v3) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add jws.IsVerificationError (#1049) * Add jws.IsVerificationError * tweak document * Merge pull request from GHSA-pvcr-v8j8-j5q3 * Add tests for empty protected headers * check for sig.protected == nil * Add one more case for missing protected headers in compact form * Update Changes * JWS: Check for sig.protected == nil on non-flattened input --------- Co-authored-by: Fredrik Strupe <fredrik@strupe.net> * Update Changes * fix typo --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Shang Jian Ding <sding3@ncsu.edu> Co-authored-by: Nathan Lacey <nlacey@novetta.com> Co-authored-by: Fredrik Strupe <fredrik@strupe.net>
This should fix all of your golang.org/x/crypto security issues.
you can reproduce this PR with following commands using tcsh
cd $GOPATH/github.com/lestrrat-go/jwx
setenv HEAD $PWD
foreach dir (
find . -type d
)cd $HEAD
cd $dir
go get -u ./...
go mod tidy
end
you'll get errors for folder that don't have go.mod files. but when you are done, all the go.mod/go.sum files will be updated