Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): Update go deps #64

Merged
merged 1 commit into from
Jun 24, 2024
Merged

chore(deps): Update go deps #64

merged 1 commit into from
Jun 24, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 24, 2024

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/cerbos/cerbos/api/genpb v0.36.1-0.20240612095234-af7a526c03b6 -> v0.37.0 age adoption passing confidence
github.com/lestrrat-go/jwx/v2 v2.0.21 -> v2.1.0 age adoption passing confidence

Release Notes

cerbos/cerbos (github.com/cerbos/cerbos/api/genpb)

v0.37.0

Compare Source

Cerbos 0.37.0

View the full release notes at https://docs.cerbos.dev/cerbos/latest/releases/v0.37.0.html

Changelog

Features
  • f2ad52f feat(repl): Autocomplete for REPL directives, and a small fix for filenames (#​2169)
  • 89e6ee9 feat: Add filtering by policy IDs to InspectPolicies RPC (#​2160)
  • 2efb5e5 feat: List local and imported variables in the policy with InspectPolicies (#​2141)
Enhancements
Bug fixes
Chores
lestrrat-go/jwx (github.com/lestrrat-go/jwx/v2)

v2.1.0

Compare Source

v2.1.0 18 Jun 2024
[New Features]
  * [jwt] Added `jwt.ParseCookie()` function
  * [jwt] `jwt.ParseRequest()` can now accept a new option, jwt.WithCookieKey() to
    specify a cookie name to extract the token from.
  * [jwt] `jwt.ParseRequest()` and `jwt.ParseCookie()` can accept the `jwt.WithCookie()` option,
    which will, upon successful token parsing, make the functions assign the *http.Cookie
    used to parse the token. This allows users to further inspect the cookie where the
    token came from, should the need arise.
  * [jwt] (BREAKING CHANGE) `jwt.ParseRequest()` no longer automatically looks for "Authorization" header when
    only `jwt.WithFormKey()` is used. This behavior is the same for `jwt.WithCookieKey()` and
    any similar options that may be implemented in the future.
### previously
      jwt.ParseRequest(req) // looks under Authorization
      jwt.ParseReuqest(req, jwt.WithFormKey("foo")) // looks under foo AND Authorization
      jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization
### since this release
      jwt.ParseRequest(req) // same as before
      jwt.ParseRequest(req, jwt.WithFormKey("foo")) // looks under foo
      jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization

  * [jwt] Add `jwt.WithResetValidators()` option to `jwt.Validate()`. This option
    will allow you to tell `jwt.Validate()` to NOT automatically check the
    default validators (`iat`, `exp`, and `nbf`), so that you can completely customize
    the validation with the validators you specify using `jwt.WithValidator()`.

    This sort of behavior is useful for special cases such as 
    https://openid.net/specs/openid-connect-rpinitiated-1_0.html. However, you SHOULD NOT
    use this option unless you know exactly what you are doing, as this will pose
    significant security issues when used incorrectly.
 
   * [jwk] Provide a _stop-gap_ measure to work with PEM format ASN.1 DER encoded secp256k1 keys.
  
    In order to enable this feature, you must compile jwx with TWO build tags:
    `jwx_es256k` to enable ES256K/secp256k1, and `jwx_secp256k1_pem` to enable PEM handling.
    Not one, but BOTH tags need to be present.

    With this change, by suppliying the `WithPEM(true)` option, `jwk.Parse()` is now
    able to read sep256k1 keys. Also, `jwk.Pem()` should be able to handle `jwk.Key` objects
    that represent a secp256k1 key.

    Please do note that the implementation of this feature is dodgy at best. Currently
    Go's crypto/x509 does not allow handling additional EC curves, and thus in order to
    accomodate secp256k1 keys in PEM/ASN.1 DER format we need to "patch" the stdlib.
    We do this by copy-and-pasting relevant parts of go 1.22.2's crypto/x509 code and
    adding the minimum required code to make secp256k1 keys work.

    Because of the above, there are several important caveats for this feature:

    1. This feature is provided solely as a stop-gap measure until such time Go's stdlib
    provides a way to handle non-standard EC curves, or another external module
    is able to solve this issue. 

    2. This feature should be considered unstable and not guaranteed by semantic versioning
    backward compatibility. At any given point we may drop or modify this feature. It may be
    because we can no longer maintain the code, or perhaps a security issue is found in the
    version of the code that we ship with, etc.
 
     3. Please always remember that we are now bundling a static set of code for handling
    x509 formats. You are taking a possible security risk by code that could be outdated.
    Please always do your own research, and if possible, please notify us if the bundled
    code needs to be updated. Unless you know what you are doing, it is not recommended
    that you enable this feature.

    4. Please note that because we imported the code from go 1.22's src/crypto/x509,
    it has some go1.20-isms in its code. Therefore you will not be able to use the
    `jwx_secp256k1_pem` tag to enable secp256k1 key PEM handling against codebases
    that are built using go 1.19 and below (the build will succeed, but the feature
    will be unavailable).

    5. We have no plans to include more curves this way. One is already one too many.

  * [jwe] Fixed a bug when using encryption algorithms involving PBES2 along with the
    jwx.WithUseNumber() global option. Enabling this option would turn all values
    stored in the JSON content to be of type `json.Number`, but we did not account for
    it when checking for the value of `p2c` header, resulting in a conversion error.

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate
chore(deps): update go deps
7c0d3c9 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Jun 24, 2024

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 11 additional dependencies were updated

Details:

Package Change
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 -> v1.34.2-20240508200655-46a4cf4ba109.2
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 -> v4.3.0
github.com/goccy/go-json v0.10.2 -> v0.10.3
golang.org/x/crypto v0.21.0 -> v0.24.0
golang.org/x/mod v0.16.0 -> v0.17.0
golang.org/x/net v0.23.0 -> v0.25.0
golang.org/x/sys v0.18.0 -> v0.21.0
golang.org/x/text v0.15.0 -> v0.16.0
golang.org/x/tools v0.19.0 -> v0.21.1-0.20240508182429-e35e4ccd0d2d
google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117 -> v0.0.0-20240610135401-a8a62080eff3
google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 -> v0.0.0-20240604185151-ef581f913117

@charithe charithe changed the title chore(deps): update go deps chore(deps): Update go deps Jun 24, 2024
@charithe charithe merged commit 04bb4e6 into main Jun 24, 2024
6 of 7 checks passed
@charithe charithe deleted the renovate/go-deps branch June 24, 2024 07:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@charithe charithe charithe approved these changes

Assignees
No one assigned
Labels
area/dependencies bots kind/chore
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@charithe