Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump the security group with 4 updates #1588

Merged
merged 1 commit into from
Jul 30, 2024

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 29, 2024

Bumps the security group with 4 updates: github.com/cilium/ebpf, github.com/containers/image/v5, golang.org/x/exp and oras.land/oras-go.

Updates github.com/cilium/ebpf from 0.11.0 to 0.16.0

Release notes

Sourced from github.com/cilium/ebpf's releases.

v0.16.0

program: automatic verifier log sizing and ProgramInfo.RecursionMisses()

For the longest time users had to specify ProgramOptions.LogSize to get the full verifier log for large programs. The library now automatically figures out the correct buffer size to use and the field is deprecated. It will be removed in the next version.

ProgramInfo now exposes how often a program didn't execute due to recursion limits via RecursionMisses.

perf, ringbuf: better control over wakeups, Flush()

There is a trade off between how fast samples are processed and how much CPU is used. Reading samples as quickly as possible uses more CPU, reading in batches is cheaper.

It's now possible to configure a "maximum time before a wakeup" by using Reader.SetDeadline(). This now guarantees that any pending samples are read at the end of the deadline, even if the Watermark wasn't reached.

It's also possible to manually flush the buffer using Flush().

Bugfixes

  • The various Copy() methods now to a full deep copy and all accept nil values.
  • link: kprobe and uprobe links can now be pinned.

What's Changed

... (truncated)

Commits
  • 061e86d map: remove misleading error message when creating without BTF
  • b689d28 btf: fix panic when copying nil Type
  • 218b9f9 program: deprecate LogSize and VerifierError.Truncated
  • 63c6cf8 map: do not allocate on lookup when key doesn't exist
  • a61222d fix a variety of Copy() problems
  • fbb9ed8 perf: do not add offline CPUs
  • 7e18818 info: make it harder to add backwards incompatible API
  • 88e8f88 link: fix nil pointer dereference in AttachXDP
  • 5976561 map: fix flaky TestMapIteratorAllocations
  • 9bd3c36 perf: fix panic when CPU is offline
  • Additional commits viewable in compare view

Updates github.com/containers/image/v5 from 5.31.1 to 5.32.0

Release notes

Sourced from github.com/containers/image/v5's releases.

v5.32.0

What's Changed

... (truncated)

Commits
  • 1bf67ef Bump to c/image v5.32.0
  • 8a0da4c Bump c/storage to v1.55.0
  • 948a118 Merge pull request #2492 from containers/renovate/github.com-docker-docker-27.x
  • ce8ec79 fix(deps): update module github.com/docker/docker to v27.1.1+incompatible
  • 3ed27f5 Merge pull request #2491 from containers/renovate/github.com-docker-cli-27.x
  • 45622ce fix(deps): update module github.com/docker/cli to v27.1.1+incompatible
  • f07be3b Merge pull request #2490 from mtrmac/bic-trivial
  • c7b3342 Clarify a comment
  • e5435e7 Avoid two consecutive ifs with the same condition
  • f107495 Fix a comment
  • Additional commits viewable in compare view

Updates golang.org/x/exp from 0.0.0-20240506185415-9bf2ced13842 to 0.0.0-20240613232115-7f521ea00fb8

Commits

Updates oras.land/oras-go from 1.2.5 to 1.2.6

Release notes

Sourced from oras.land/oras-go's releases.

v1.2.6

[!IMPORTANT] v1.2.6 now requires Go 1.22.4 due to updated dependencies.

What's Changed

... (truncated)

Commits
  • 33602cb build(deps): bump github.com/docker/cli from 27.0.3+incompatible to 27.1.0+in...
  • 9b335d9 build(deps): bump github.com/docker/docker from 27.0.3+incompatible to 27.1.0...
  • eed6b68 build(deps): bump github.com/containerd/containerd from 1.7.19 to 1.7.20 (#792)
  • fe1d951 build(deps): bump github.com/distribution/distribution/v3 from 3.0.0-alpha.1 ...
  • 7b97f0f build(go): upgrade go version to v1.22 (#790)
  • 34d9273 build(deps): bump github.com/containerd/containerd from 1.7.18 to 1.7.19 (#786)
  • 05075fe build(deps): bump golang.org/x/crypto from 0.24.0 to 0.25.0 (#787)
  • 09f3f35 build(deps): bump github.com/docker/cli from 27.0.2+incompatible to 27.0.3+in...
  • 036fe14 build(deps): bump github.com/docker/docker from 27.0.2+incompatible to 27.0.3...
  • 5c7f84c build(deps): bump github.com/docker/docker from 26.1.3+incompatible to 27.0.2...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the security group with 4 updates: [github.com/cilium/ebpf](https://github.com/cilium/ebpf), [github.com/containers/image/v5](https://github.com/containers/image), [golang.org/x/exp](https://github.com/golang/exp) and [oras.land/oras-go](https://github.com/oras-project/oras-go).


Updates `github.com/cilium/ebpf` from 0.11.0 to 0.16.0
- [Release notes](https://github.com/cilium/ebpf/releases)
- [Commits](cilium/ebpf@v0.11.0...v0.16.0)

Updates `github.com/containers/image/v5` from 5.31.1 to 5.32.0
- [Release notes](https://github.com/containers/image/releases)
- [Commits](containers/image@v5.31.1...v5.32.0)

Updates `golang.org/x/exp` from 0.0.0-20240506185415-9bf2ced13842 to 0.0.0-20240613232115-7f521ea00fb8
- [Commits](https://github.com/golang/exp/commits)

Updates `oras.land/oras-go` from 1.2.5 to 1.2.6
- [Release notes](https://github.com/oras-project/oras-go/releases)
- [Commits](oras-project/oras-go@v1.2.5...v1.2.6)

---
updated-dependencies:
- dependency-name: github.com/cilium/ebpf
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security
- dependency-name: github.com/containers/image/v5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security
- dependency-name: golang.org/x/exp
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: oras.land/oras-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
...

Signed-off-by: dependabot[bot] <support@github.com>
Copy link

@replicated-ci replicated-ci left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

This PR was automatically approved and merged by the automated-prs-manager GitHub action

@replicated-ci replicated-ci merged commit 16237e4 into main Jul 30, 2024
27 checks passed
@replicated-ci replicated-ci deleted the dependabot/go_modules/security-f3d47c5bb7 branch July 30, 2024 00:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant