Bump the go-modules group across 1 directory with 14 updates #429

dependabot · 2025-03-05T00:16:52Z

Bumps the go-modules group with 8 updates in the / directory:

Package	From	To
github.com/paketo-buildpacks/occam	`0.20.0`	`0.22.0`
github.com/google/go-cmp	`0.6.0`	`0.7.0`
github.com/klauspost/compress	`1.17.11`	`1.18.0`
github.com/opencontainers/image-spec	`1.1.0`	`1.1.1`
github.com/vbatts/tar-split	`0.11.6`	`0.12.1`
golang.org/x/crypto	`0.32.0`	`0.35.0`
golang.org/x/net	`0.34.0`	`0.36.0`
google.golang.org/grpc	`1.69.4`	`1.71.0`

Updates github.com/paketo-buildpacks/occam from 0.20.0 to 0.22.0

Release notes

Sourced from github.com/paketo-buildpacks/occam's releases.

v0.22.0

What's Changed

Multi arch support by @pacostas in paketo-buildpacks/occam#357

Full Changelog: paketo-buildpacks/occam@v0.21.0...v0.22.0

v0.21.0

What's Changed

fix: linter and tests by @nicolasbender in paketo-buildpacks/occam#354

feat: filematchers follow symlinks by @nicolasbender in paketo-buildpacks/occam#356

New Contributors

@nicolasbender made their first contribution in paketo-buildpacks/occam#354

Full Changelog: paketo-buildpacks/occam@v0.20.0...v0.21.0

Commits

17405e7 test: adding tests for testing withTarget option
cd0bf3c updating occam with freezer
fee28ca fix: Matching the relocated file usr/lib/os-release
2d9980f feat: filematchers follow symlinks (#356)
4a10044 update upload-artifact from v3 to v4
e1c187a Fix test issue
388f653 Fix linter issue
67d2dc2 Update dependecies
See full diff in compare view

Updates github.com/ForestEckhardt/freezer from 0.1.0 to 0.1.1

Release notes

Sourced from github.com/ForestEckhardt/freezer's releases.

v0.1.1

What's Changed

Multi-arch support when downloading and caching assets by @pacostas in ForestEckhardt/freezer#12

New Contributors

@pacostas made their first contribution in ForestEckhardt/freezer#12

Full Changelog: paketo-buildpacks/freezer@v0.1.0...v0.1.1

Commits

08ee7c5 fix: Fetching release assets properly
See full diff in compare view

Updates github.com/google/go-cmp from 0.6.0 to 0.7.0

Release notes

Sourced from github.com/google/go-cmp's releases.

v0.7.0

New API:

(#367) Support compare functions with SortSlices and SortMaps

Panic messaging:

(#370) Detect proto.Message types when failing to export a field

Commits

9b12f36 Detect proto.Message types when failing to export a field (#370)
4dd3d63 fix: type 'aribica' => 'arabica' (#368)
391980c Support compare functions with SortSlices and SortMaps (#367)
See full diff in compare view

Updates github.com/klauspost/compress from 1.17.11 to 1.18.0

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.18.0

What's Changed

Deprecate Go 1.21 and add 1.24 by @klauspost in klauspost/compress#1055

Add unsafe little endian loaders by @klauspost in klauspost/compress#1036

fix: check r.err != nil but return a nil value error err by @alingse in klauspost/compress#1028

refactor: use built-in min function by @Juneezee in klauspost/compress#1038

zstd: use slices.Max for max value in slice by @Juneezee in klauspost/compress#1041

flate: Simplify L4-6 loading by @klauspost in klauspost/compress#1043

flate: Simplify matchlen (remove asm) by @klauspost in klauspost/compress#1045

s2: Add block decode fuzzer by @klauspost in klauspost/compress#1044

s2: Improve small block compression speed w/o asm by @klauspost in klauspost/compress#1048

flate: Fix matchlen L5+L6 by @klauspost in klauspost/compress#1049

flate: Cleanup & reduce casts by @klauspost in klauspost/compress#1050

New Contributors

@tcpdumppy made their first contribution in klauspost/compress#1021

@sam9291 made their first contribution in klauspost/compress#1022

@dezza made their first contribution in klauspost/compress#1023

@alingse made their first contribution in klauspost/compress#1028

@hyunsooda made their first contribution in klauspost/compress#1031

@Juneezee made their first contribution in klauspost/compress#1038

@Bbulatov made their first contribution in klauspost/compress#1052

Full Changelog: klauspost/compress@v1.17.11...v1.18.0

Commits

8e79dc4 Deprecate Go 1.21 and add 1.24 (#1055)
df8e99c build(deps): bump the github-actions group with 2 updates (#1053)
7787431 zstd: fix unused debug code (#1052)
0bf3ecb flate: Cleanup & reduce casts (#1050)
e0f89a9 flate: Fix matchlen L5+L6 (#1049)
c8a8470 s2: Improve small block compression speed w/o asm (#1048)
b05b993 s2: Add block decode fuzzer (#1044)
aafbabd flate: Simplify matchlen (remove asm) (#1045)
dbaa9c1 flate: Simplify l4-6 loading (#1043)
4fa2036 Add unsafe little endian loaders (#1036)
Additional commits viewable in compare view

Updates github.com/lufia/plan9stats from 0.0.0-20211012122336-39d0f177ccd0 to 0.0.0-20240909124753-873cd0166683

Commits

See full diff in compare view

Updates github.com/opencontainers/image-spec from 1.1.0 to 1.1.1

Release notes

Sourced from github.com/opencontainers/image-spec's releases.

v1.1.1

Vote Passed [+5 -0 nv1] - https://groups.google.com/a/opencontainers.org/g/dev/c/T-olx0jdT18 Release PR : opencontainers/image-spec#1247 Full Changelog: opencontainers/image-spec@v1.1.0...v1.1.1

Commits

147f9c1 Release v1.1.1
fbb4662 Merge pull request #1238 from mkenigs/wording-nit
81e457e Fix grammar nit
92353b0 Merge pull request #1225 from sudo-bmitch/pr-doc-go-version
1a0b9f9 Merge pull request #1230 from sudo-bmitch/pr-layout-extensibility
f272635 Merge pull request #1228 from sudo-bmitch/pr-mixed-digest-algo
e0462ab Merge pull request #1229 from tianon/setup-go
cf536e3 Merge pull request #1227 from sudo-bmitch/pr-rm-project-doc
60acaac Document extensibility of the image layout
4dcf962 Document Go version policy
Additional commits viewable in compare view

Updates github.com/power-devops/perfstat from 0.0.0-20210106213030-5aafc221ea8c to 0.0.0-20240221224432-82ca36839d55

Commits

See full diff in compare view

Updates github.com/vbatts/tar-split from 0.11.6 to 0.12.1

Release notes

Sourced from github.com/vbatts/tar-split's releases.

v0.12.1

Apologies for the disruptions! 😽 This release reverts the (breaking) change of making our carried version of archive/tar private. (that was apparently a scream test of sorts 😬 ) And patches the other side of the CVE-2022-2879 for the tar.Writer.

Thanks @mtrmac for the quick iteration.

v0.12.0

Notably this release only makes the carried version of archive/tar now an internal library so that it's not importable outside of this project.

Reference: #79 , #80

v0.11.7

This release addresses CVE-2022-2879

Thanks to @tojoos and @bainsy88 for the report

Commits

ced2b07 Merge pull request #84 from vbatts/bumpversion
90e3f6c version: bump to v0.12.1
a4bd92b Merge pull request #83 from vbatts/patch_archive_tar_writer
b28263d Merge pull request #82 from vbatts/make_external
0a078f2 archive/tar: fix the archive/tar.Writer CVE
b8ca13f Revert "*.go: move the carrierd archive/tar to internal/"
bca84be Merge pull request #80 from vbatts/versionbump
db85147 version: bump to 0.12.0
605093c Merge pull request #79 from vbatts/make_internal
c8b16f6 *.go: move the carrierd archive/tar to internal/
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.32.0 to 0.35.0

Commits

7292932 ssh: limit the size of the internal packet queue while waiting for KEX
f66f74b acme/autocert: check host policy before probing the cache
b0784b7 x509roots/fallback: drop obsolete build constraint
911360c all: bump golang.org/x/crypto dependencies of asm generators
89ff08d all: upgrade go directive to at least 1.23.0 [generated]
e47973b all: update certs for go1.24
9290511 go.mod: update golang.org/x dependencies
fa5273e x509roots/fallback: update bundle
a8ea4be ssh: add ServerConfig.PreAuthConnCallback, ServerPreAuthConn (banner) interface
71d3a4c acme: support challenges that require the ACME client to send a non-empty JSO...
See full diff in compare view

Updates golang.org/x/net from 0.34.0 to 0.36.0

Commits

85d1d54 go.mod: update golang.org/x dependencies
cde1dda proxy, http/httpproxy: do not mismatch IPv6 zone ids against hosts
fe7f039 publicsuffix: spruce up code gen and speed up PublicSuffix
459513d internal/http3: move more common stream processing to genericConn
aad0180 http2: fix flakiness from t.Log when GOOS=js
b73e574 http2: don't log expected errors from writing invalid trailers
5f45c77 internal/http3: make read-data tests usable for server handlers
43c2540 http2, internal/httpcommon: reject userinfo in :authority
1d78a08 http2, internal/httpcommon: factor out server header logic for h2/h3
0d7dc54 quic: add Conn.ConnectionState
Additional commits viewable in compare view

Updates golang.org/x/sync from 0.10.0 to 0.11.0

Commits

fe3591b sync/errgroup: improve documentation for semaphore limit behavior
See full diff in compare view

Updates golang.org/x/sys from 0.29.0 to 0.30.0

Commits

863b3c4 unix: update glibc to 2.41
4d4692e unix: add Auxv
b215a1c unix: update to Linux kernel 6.13
c756214 cpu: add support for AVX-VNNI and IFMA detection
1c14dca unix: add GetPeerUcred and UcredGet for solaris
See full diff in compare view

Updates golang.org/x/text from 0.21.0 to 0.22.0

Commits

3b64043 go.mod: update golang.org/x dependencies
1e59086 message/pipeline: add two Unalias calls
See full diff in compare view

Updates google.golang.org/grpc from 1.69.4 to 1.71.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.71.0

API Changes

balancer: Custom LB policies that record metrics must use the new MetricsRecorder method on Balancer.ClientConn instead of the removed Balancer.BuildOptions.MetricsRecorder field to obtain a metrics recorder. (#8027)

balancer: balancer.ClientConn implementations must now embed a delegate implementation. This allows grpc-go to add new methods to the interface and remain backward compatible. (#8026)

balancer/endpointsharding: The constructor accepts the child balancer's builder and a struct with optional configuration. (#8052)

New Features

xds: Add support for dualstack via the additional_addresses field in the Endpoint resource. To disable this feature, set the environment variable GRPC_EXPERIMENTAL_XDS_DUALSTACK_ENDPOINTS=false. (#8134)

stats/opentelemetry: Add experimental support for OpenTelemetry tracing. (#7852)

xds/internal/xdsclient: Add counter metrics for valid and invalid resource updates. (#8038)

balancer/leastrequest, roundrobin: Add dualstack support. (#7969, #7966)

balancer/endpointsharding: Balancers created with the new DisableAutoReconnect option will not attempt to call ExitIdle automatically on their children when the children report idle. (#8052)

Bug Fixes

client: Fix support for proxies when using grpc.NewClient so the target is resolved by the proxy as expected. (#7881)

Added WithLocalDNSResolution() dial option to explicitly force target resolution on the client instead. (#7881)

weightedtarget: Return erroring picker when no targets are configured. (#8070)

xds: Fail RPCs with UNAVAILABLE when the EDS resource is missing or contains no endpoints (#8070)

xdsclient: Fix a bug where connectivity failures were reported to resource watchers before trying all listed servers. (#8075)

grpc: Fix the number of bytes reported in the error message when encoded messages are larger than 4GB. (#8033)

xds: Fixed a bug preventing tests from creating multiple servers or channels with different bootstrap configs. (#8050)

grpc: Fix message length checks when compression is enabled and maxReceiveMessageSize is MaxInt (#7918)

Special Thanks: @vinothkumarr227

Documentation

client: Improve documentation of grpc.NewClient and ClientConn.CanonicalTarget by providing examples. (#8078)

examples/features/dualstack: New example demonstrating usage of endpoints and dualstack functionality. (#8098)

Release 1.70.0

Behavior Changes

client: reject service configs containing an invalid retryPolicy in accordance with gRFCs A21 and A6. (#7905)

Note that this is a potential breaking change for some users using an invalid configuration, but continuing to allow this behavior would violate our cross-language compatibility requirements.

New Features

xdsclient: fallback to a secondary management server (if specified in the bootstrap configuration) when the primary is down is enabled by default. Can be disabled by setting the environment variable GRPC_EXPERIMENTAL_XDS_FALLBACK to false. (#7949)

experimental/credentials: experimental transport credentials are added which don't enforce ALPN. (#7980)

These credentials will be removed in an upcoming grpc-go release. Users must not rely on these credentials directly. Instead, they should either vendor a specific version of gRPC or copy the relevant credentials into their own codebase if absolutely necessary.

Bug Fixes

xds: fix a possible deadlock that happens when both the client application and the xDS management server (responsible for configuring the client) are using the xds:/// scheme in their target URIs. (#8011)

Performance

... (truncated)

Commits

d01db5c Change version to 1.71.0 (#8105)
012f8bf xds: Enable dualstack flag (#8134)
bf0c885 examples/features/dualstack: Demonstrate Dual Stack functionality (#8098) (#8...
05bdd66 ringhash: Remove TODO comment (#8096)
ddb2484 xds: remove obsolete xDS transport custom dialer option (#8079)
8528f43 cleanup: replace Dial with NewClient (#7975)
ae2a04f ringhash: Replace DNS resolver before sending xDS Update in test (#8091)
e55819e lazy: Use channel to wait for resolver error being received in test (#8088)
b524c08 xdsclient: include xds node ID in errors from the WatchResource API (#8093)
91eb6aa client: improve documentation of target strings (#8078)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-modules group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/paketo-buildpacks/occam](https://github.com/paketo-buildpacks/occam) | `0.20.0` | `0.22.0` | | [github.com/google/go-cmp](https://github.com/google/go-cmp) | `0.6.0` | `0.7.0` | | [github.com/klauspost/compress](https://github.com/klauspost/compress) | `1.17.11` | `1.18.0` | | [github.com/opencontainers/image-spec](https://github.com/opencontainers/image-spec) | `1.1.0` | `1.1.1` | | [github.com/vbatts/tar-split](https://github.com/vbatts/tar-split) | `0.11.6` | `0.12.1` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.32.0` | `0.35.0` | | [golang.org/x/net](https://github.com/golang/net) | `0.34.0` | `0.36.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.69.4` | `1.71.0` | Updates `github.com/paketo-buildpacks/occam` from 0.20.0 to 0.22.0 - [Release notes](https://github.com/paketo-buildpacks/occam/releases) - [Commits](paketo-buildpacks/occam@v0.20.0...v0.22.0) Updates `github.com/ForestEckhardt/freezer` from 0.1.0 to 0.1.1 - [Release notes](https://github.com/ForestEckhardt/freezer/releases) - [Commits](paketo-buildpacks/freezer@v0.1.0...v0.1.1) Updates `github.com/google/go-cmp` from 0.6.0 to 0.7.0 - [Release notes](https://github.com/google/go-cmp/releases) - [Commits](google/go-cmp@v0.6.0...v0.7.0) Updates `github.com/klauspost/compress` from 1.17.11 to 1.18.0 - [Release notes](https://github.com/klauspost/compress/releases) - [Changelog](https://github.com/klauspost/compress/blob/master/.goreleaser.yml) - [Commits](klauspost/compress@v1.17.11...v1.18.0) Updates `github.com/lufia/plan9stats` from 0.0.0-20211012122336-39d0f177ccd0 to 0.0.0-20240909124753-873cd0166683 - [Commits](https://github.com/lufia/plan9stats/commits) Updates `github.com/opencontainers/image-spec` from 1.1.0 to 1.1.1 - [Release notes](https://github.com/opencontainers/image-spec/releases) - [Changelog](https://github.com/opencontainers/image-spec/blob/main/RELEASES.md) - [Commits](opencontainers/image-spec@v1.1.0...v1.1.1) Updates `github.com/power-devops/perfstat` from 0.0.0-20210106213030-5aafc221ea8c to 0.0.0-20240221224432-82ca36839d55 - [Commits](https://github.com/power-devops/perfstat/commits) Updates `github.com/vbatts/tar-split` from 0.11.6 to 0.12.1 - [Release notes](https://github.com/vbatts/tar-split/releases) - [Commits](vbatts/tar-split@v0.11.6...v0.12.1) Updates `golang.org/x/crypto` from 0.32.0 to 0.35.0 - [Commits](golang/crypto@v0.32.0...v0.35.0) Updates `golang.org/x/net` from 0.34.0 to 0.36.0 - [Commits](golang/net@v0.34.0...v0.36.0) Updates `golang.org/x/sync` from 0.10.0 to 0.11.0 - [Commits](golang/sync@v0.10.0...v0.11.0) Updates `golang.org/x/sys` from 0.29.0 to 0.30.0 - [Commits](golang/sys@v0.29.0...v0.30.0) Updates `golang.org/x/text` from 0.21.0 to 0.22.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.21.0...v0.22.0) Updates `google.golang.org/grpc` from 1.69.4 to 1.71.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.69.4...v1.71.0) --- updated-dependencies: - dependency-name: github.com/paketo-buildpacks/occam dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/ForestEckhardt/freezer dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/google/go-cmp dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/klauspost/compress dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/lufia/plan9stats dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/opencontainers/image-spec dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/power-devops/perfstat dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/vbatts/tar-split dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: golang.org/x/crypto dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: golang.org/x/net dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: golang.org/x/sync dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: golang.org/x/sys dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: golang.org/x/text dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: google.golang.org/grpc dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot requested a review from a team as a code owner March 5, 2025 00:16

dependabot bot added the failure:update-dependencies An issue filed automatically when updating buildpack.toml dependencies fails in a workflow label Mar 5, 2025

dependabot bot requested review from mhdawson and pacostas March 5, 2025 00:16

paketo-bot added the semver:patch A change requiring a patch version bump label Mar 5, 2025

paketo-bot-reviewer approved these changes Mar 5, 2025

View reviewed changes

paketo-bot merged commit 1fb58c7 into main Mar 5, 2025
11 of 12 checks passed

paketo-bot deleted the dependabot/go_modules/go-modules-c67143c423 branch March 5, 2025 00:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the go-modules group across 1 directory with 14 updates #429

Bump the go-modules group across 1 directory with 14 updates #429

Uh oh!

dependabot bot commented on behalf of github Mar 5, 2025

Uh oh!

Uh oh!

Uh oh!

Bump the go-modules group across 1 directory with 14 updates #429

Bump the go-modules group across 1 directory with 14 updates #429

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 5, 2025

v0.22.0

What's Changed

v0.21.0

What's Changed

New Contributors

v0.1.1

What's Changed

New Contributors

v0.7.0

v1.18.0

What's Changed

New Contributors

v1.1.1

v0.12.1

v0.12.0

v0.11.7

Release 1.71.0

API Changes

New Features

Bug Fixes

Documentation

Release 1.70.0

Behavior Changes

New Features

Bug Fixes

Performance

Uh oh!

Uh oh!

Uh oh!