Commit 819c491
authored
chore(deps): bump the go-dependencies group across 1 directory with 4 updates (#83)
Bumps the go-dependencies group with 4 updates in the / directory:
[github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go),
[github.com/go-git/go-git/v5](https://github.com/go-git/go-git),
[github.com/google/go-containerregistry](https://github.com/google/go-containerregistry)
and gopkg.in/ini.v1.
Updates `github.com/compose-spec/compose-go/v2` from 2.10.2 to 2.11.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/compose-spec/compose-go/releases">github.com/compose-spec/compose-go/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.11.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: add UnmarshalJSON and UnmarshalYAML to UnitBytes by <a
href="https://github.com/Venkatesh1505"><code>@Venkatesh1505</code></a>
in <a
href="https://redirect.github.com/compose-spec/compose-go/pull/867">compose-spec/compose-go#867</a></li>
<li>bump JSON Schema to draft 2020-12 by <a
href="https://github.com/ndeloof"><code>@ndeloof</code></a> in <a
href="https://redirect.github.com/compose-spec/compose-go/pull/864">compose-spec/compose-go#864</a></li>
<li>fix: preserve empty slices in OmitEmpty for schema validation by <a
href="https://github.com/glours"><code>@glours</code></a> in <a
href="https://redirect.github.com/compose-spec/compose-go/pull/873">compose-spec/compose-go#873</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/Venkatesh1505"><code>@Venkatesh1505</code></a>
made their first contribution in <a
href="https://redirect.github.com/compose-spec/compose-go/pull/867">compose-spec/compose-go#867</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/compose-spec/compose-go/compare/v2.10.2...v2.11.0">https://github.com/compose-spec/compose-go/compare/v2.10.2...v2.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/compose-spec/compose-go/commit/468e3142d7878f6ec8f0c99e3e64c913cf3d3148"><code>468e314</code></a>
fix(reset): add caching and visit limits to alias resolution</li>
<li><a
href="https://github.com/compose-spec/compose-go/commit/c9079e967f2a221810ddec3f5051833f6a47516b"><code>c9079e9</code></a>
fix: preserve empty slices in OmitEmpty for schema validation</li>
<li><a
href="https://github.com/compose-spec/compose-go/commit/e350f0840447f1c64229ebfd933c862a9263fc16"><code>e350f08</code></a>
bump JSON Schema to draft 2020-12</li>
<li><a
href="https://github.com/compose-spec/compose-go/commit/f8882ec09ce838db93f2a3ca24de758b8bd379b7"><code>f8882ec</code></a>
fix: use go.yaml.in/yaml/v4 instead of gopkg.in/yaml.v3</li>
<li><a
href="https://github.com/compose-spec/compose-go/commit/514d71de2297bd87b38a8b034acc443368644ac4"><code>514d71d</code></a>
refactor: use parseString method on receiver and reuse in
DecodeMapstructure</li>
<li><a
href="https://github.com/compose-spec/compose-go/commit/3db73305a9347bb4fe021a48a47a8c468e2d2810"><code>3db7330</code></a>
fix: add UnmarshalJSON and UnmarshalYAML to UnitBytes for round-trip
support</li>
<li>See full diff in <a
href="https://github.com/compose-spec/compose-go/compare/v2.10.2...v2.11.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `github.com/go-git/go-git/v5` from 5.18.0 to 5.19.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.19.1</h2>
<h2>What's Changed</h2>
<ul>
<li>v5: plumbing: transport/ssh, Shell-quote path by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2068">go-git/go-git#2068</a></li>
<li>v5: git: submodule, Fix relative URL resolution by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2070">go-git/go-git#2070</a></li>
<li>v5: git: submodule, canonical remote for relative URLs by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2074">go-git/go-git#2074</a></li>
<li>v5: git: submodule, error on remote without URLs by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2078">go-git/go-git#2078</a></li>
<li>v5: plumbing: format/idxfile, Validate offset64 indices by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2084">go-git/go-git#2084</a></li>
<li>v5: *: Reject malformed variable-length integers by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2092">go-git/go-git#2092</a></li>
<li>v5: plumbing: format/packfile, Tighten delta validation by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2091">go-git/go-git#2091</a></li>
<li>v5: Add <code>worktreeFilesystem</code> wrapper for worktree and
hardening by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2100">go-git/go-git#2100</a></li>
<li>v5: config: validate submodule names by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2082">go-git/go-git#2082</a></li>
<li>build: Update module github.com/go-git/go-git/v5 to v5.19.0
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2111">go-git/go-git#2111</a></li>
<li>v5: git: Allow MkdirAll on worktree-root paths by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2117">go-git/go-git#2117</a></li>
<li>v5: git: Stop validating symlink target paths by <a
href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2116">go-git/go-git#2116</a></li>
<li>v5: plumbing: format decoder input bounds and contracts by <a
href="https://github.com/hiddeco"><code>@hiddeco</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2125">go-git/go-git#2125</a></li>
<li>plumbing: format/packfile, cap delta chain depth in parser by <a
href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2137">go-git/go-git#2137</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1">https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1</a></p>
<h2>v5.19.0</h2>
<h2>What's Changed</h2>
<ul>
<li>build: Update module github.com/go-git/go-git/v5 to v5.18.0
[SECURITY] (releases/v5.x) by <a
href="https://github.com/go-git-renovate"><code>@go-git-renovate</code></a>[bot]
in <a
href="https://redirect.github.com/go-git/go-git/pull/2010">go-git/go-git#2010</a></li>
<li>v5: Bump sha1cd and go-billy by <a
href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2060">go-git/go-git#2060</a></li>
<li>v5: Align object encoding with upstream by <a
href="https://github.com/pjbgf"><code>@pjbgf</code></a> in <a
href="https://redirect.github.com/go-git/go-git/pull/2065">go-git/go-git#2065</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0">https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-git/go-git/commit/3c3be601aa6c0fd0d536c0d1e4f898b4c60e65fe"><code>3c3be60</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2137">#2137</a>
from go-git/validate-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/3fba897bd9e84b1aec170fa708b80e297b7d6cf6"><code>3fba897</code></a>
plumbing: format/packfile, cap delta chain depth in parser</li>
<li><a
href="https://github.com/go-git/go-git/commit/a97d6601c85e017bb64c2b0f2e3169f6ef6a6709"><code>a97d660</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2125">#2125</a>
from hiddeco/v5/format-input-bounds</li>
<li><a
href="https://github.com/go-git/go-git/commit/aeaa125c8af8e4c4c95b574c22c5633e97fc436e"><code>aeaa125</code></a>
plumbing: format/objfile, require Header before Read</li>
<li><a
href="https://github.com/go-git/go-git/commit/1f38e171218526ea254a73187a52f0648253c1b8"><code>1f38e17</code></a>
plumbing: format/packfile, bound inflate size</li>
<li><a
href="https://github.com/go-git/go-git/commit/f7545a02529e03998d6a7219140dc0e6644ad337"><code>f7545a0</code></a>
plumbing: format/idxfile, bound nr by file size</li>
<li><a
href="https://github.com/go-git/go-git/commit/170b88181f385913a457a08b68c88956fb3f8e4f"><code>170b881</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2116">#2116</a>
from pjbgf/symlink-v5</li>
<li><a
href="https://github.com/go-git/go-git/commit/7b6d994467f06630268904aa3c441b6de7248b31"><code>7b6d994</code></a>
Merge pull request <a
href="https://redirect.github.com/go-git/go-git/issues/2117">#2117</a>
from hiddeco/v5/worktree-fs-mkdirall-root-noop</li>
<li><a
href="https://github.com/go-git/go-git/commit/f0709b32f8fbb87c16cd63c6762d2cd515f36541"><code>f0709b3</code></a>
git: Stop validating symlink target paths</li>
<li><a
href="https://github.com/go-git/go-git/commit/776d00f11d336f26862d0f2bab987b217f3a7844"><code>776d00f</code></a>
git: Allow MkdirAll on worktree-root paths</li>
<li>Additional commits viewable in <a
href="https://github.com/go-git/go-git/compare/v5.18.0...v5.19.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `github.com/google/go-containerregistry` from 0.21.5 to 0.21.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/google/go-containerregistry/releases">github.com/google/go-containerregistry's
releases</a>.</em></p>
<blockquote>
<h2>v0.21.6</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: update dependencies to use new azure sdk components by <a
href="https://github.com/gaganhr94"><code>@gaganhr94</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2262">google/go-containerregistry#2262</a></li>
<li>transport: restore resp.Body in retryError so CheckError can parse
it by <a
href="https://github.com/alliasgher"><code>@alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2264">google/go-containerregistry#2264</a></li>
<li>pkg/registry: return 202 Accepted for PATCH chunk uploads by <a
href="https://github.com/alliasgher"><code>@alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2265">google/go-containerregistry#2265</a></li>
<li>Follow OCI distribution spec for artifactType and annotations by <a
href="https://github.com/malt3"><code>@malt3</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2269">google/go-containerregistry#2269</a></li>
<li>actions: attach Codecov token to coverage tests on main by <a
href="https://github.com/Subserial"><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2270">google/go-containerregistry#2270</a></li>
<li>remote: use DeleteScope (with "delete" action) for
manifest deletion by <a
href="https://github.com/alliasgher"><code>@alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2266">google/go-containerregistry#2266</a></li>
<li>remote: limit concurrent layer pulls by <a
href="https://github.com/gnix0"><code>@gnix0</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2271">google/go-containerregistry#2271</a></li>
<li>pkg/registry: reject corrupt disk blobs by <a
href="https://github.com/gnix0"><code>@gnix0</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2272">google/go-containerregistry#2272</a></li>
<li>mutate: close layer readers during export by <a
href="https://github.com/gnix0"><code>@gnix0</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2277">google/go-containerregistry#2277</a></li>
<li>crane/flatten: preserve image media type when flattening by <a
href="https://github.com/alliasgher"><code>@alliasgher</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2267">google/go-containerregistry#2267</a></li>
<li>build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1
in the actions group across 1 directory by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2273">google/go-containerregistry#2273</a></li>
<li>build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by
<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2278">google/go-containerregistry#2278</a></li>
<li>build(deps): bump the go-deps group across 3 directories with 6
updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2280">google/go-containerregistry#2280</a></li>
<li>Replace go-homedir with os.UserHomeDir by <a
href="https://github.com/jammie-jelly"><code>@jammie-jelly</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2282">google/go-containerregistry#2282</a></li>
<li>pkg/name: only treat .localhost as non-HTTPS, not .local by <a
href="https://github.com/blackwell-systems"><code>@blackwell-systems</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2281">google/go-containerregistry#2281</a></li>
<li>transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL
by <a href="https://github.com/marwan9696"><code>@marwan9696</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2285">google/go-containerregistry#2285</a></li>
<li>test(mutate): add Extract round-trip test for filesystem object
preservation by <a
href="https://github.com/blackwell-systems"><code>@blackwell-systems</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2283">google/go-containerregistry#2283</a></li>
<li>experiments: remove deprecated support for estargz by <a
href="https://github.com/thaJeztah"><code>@thaJeztah</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2288">google/go-containerregistry#2288</a></li>
<li>build(deps): bump aws-actions/configure-aws-credentials from 6.1.0
to 6.1.1 in the actions group by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2289">google/go-containerregistry#2289</a></li>
<li>fix: limit HTTP response body reads to prevent OOM by <a
href="https://github.com/evilgensec"><code>@evilgensec</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2296">google/go-containerregistry#2296</a></li>
<li>build(deps): bump the go-deps group across 3 directories with 6
updates by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2297">google/go-containerregistry#2297</a></li>
<li>transport: block redirects from token server to private/link-local
addresses (SSRF fix) by <a
href="https://github.com/evilgensec"><code>@evilgensec</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2292">google/go-containerregistry#2292</a></li>
<li>pkg/v1/mutate: preserve relative symlinks that stay within rootfs in
Extract by <a
href="https://github.com/anishesg"><code>@anishesg</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2279">google/go-containerregistry#2279</a></li>
<li>validate: skip non-layer layers by <a
href="https://github.com/imjasonh"><code>@imjasonh</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2298">google/go-containerregistry#2298</a></li>
<li>remote: validate foreign layer URLs to prevent SSRF (fixes <a
href="https://redirect.github.com/google/go-containerregistry/issues/2259">#2259</a>)
by <a href="https://github.com/evilgensec"><code>@evilgensec</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2293">google/go-containerregistry#2293</a></li>
<li>remote: block SSRF via private-IP Location headers in blob uploads
by <a
href="https://github.com/adilburaksen"><code>@adilburaksen</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2295">google/go-containerregistry#2295</a></li>
<li>fix(mutate): preserve config blob and layers for non-Docker OCI
artifacts by <a
href="https://github.com/blackwell-systems"><code>@blackwell-systems</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2286">google/go-containerregistry#2286</a></li>
<li>fix: preserve per-occurrence layer identity in mutate.Image.Layers()
by <a href="https://github.com/iahsanGill"><code>@iahsanGill</code></a>
in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2299">google/go-containerregistry#2299</a></li>
<li>transport: retry HTTP 429 (Too Many Requests) by <a
href="https://github.com/iahsanGill"><code>@iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2301">google/go-containerregistry#2301</a></li>
<li>transport: allow bearer realm at same host:port as registry by <a
href="https://github.com/iahsanGill"><code>@iahsanGill</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2302">google/go-containerregistry#2302</a></li>
<li>Update go version to 1.26.3 by <a
href="https://github.com/Subserial"><code>@Subserial</code></a> in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2300">google/go-containerregistry#2300</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/gaganhr94"><code>@gaganhr94</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2262">google/go-containerregistry#2262</a></li>
<li><a
href="https://github.com/alliasgher"><code>@alliasgher</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2264">google/go-containerregistry#2264</a></li>
<li><a href="https://github.com/malt3"><code>@malt3</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2269">google/go-containerregistry#2269</a></li>
<li><a href="https://github.com/gnix0"><code>@gnix0</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2271">google/go-containerregistry#2271</a></li>
<li><a
href="https://github.com/blackwell-systems"><code>@blackwell-systems</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2281">google/go-containerregistry#2281</a></li>
<li><a
href="https://github.com/marwan9696"><code>@marwan9696</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2285">google/go-containerregistry#2285</a></li>
<li><a href="https://github.com/anishesg"><code>@anishesg</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2279">google/go-containerregistry#2279</a></li>
<li><a
href="https://github.com/adilburaksen"><code>@adilburaksen</code></a>
made their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2295">google/go-containerregistry#2295</a></li>
<li><a
href="https://github.com/iahsanGill"><code>@iahsanGill</code></a> made
their first contribution in <a
href="https://redirect.github.com/google/go-containerregistry/pull/2299">google/go-containerregistry#2299</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6">https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/google/go-containerregistry/commit/53f7e39e15bfd6aeea6a5f733ee1a8fcf54c15cf"><code>53f7e39</code></a>
Update go version to 1.26.3 (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2300">#2300</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/bf87c3bfe4cc3218ac0baa364545d72729d2906d"><code>bf87c3b</code></a>
transport: allow bearer realm at same host:port as registry (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2302">#2302</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/c55facddfbd7fc3d648c6fdda9860b350b013a76"><code>c55facd</code></a>
transport: retry HTTP 429 (Too Many Requests) (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2301">#2301</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/68a569e4a0eb927d36ccb0fcdf4578425c03b5a2"><code>68a569e</code></a>
fix: preserve per-occurrence layer identity in Layers() (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2299">#2299</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/35b354b436879457221028f05a580fe1c0deccbc"><code>35b354b</code></a>
fix(mutate): preserve config blob and layers for non-Docker OCI
artifacts (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2">#2</a>...</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/e5983f2a67ec46b76984ce6de85de08a44eee955"><code>e5983f2</code></a>
remote: block SSRF via private-IP Location headers in blob uploads (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2295">#2295</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/6dad820da7de0d619f1127c46914f2eaf58e3b46"><code>6dad820</code></a>
remote: validate foreign layer URLs to prevent SSRF (fixes <a
href="https://redirect.github.com/google/go-containerregistry/issues/2259">#2259</a>)
(<a
href="https://redirect.github.com/google/go-containerregistry/issues/2293">#2293</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/78bdf1b7e2105cdfcd8f23509992c78357ce16ed"><code>78bdf1b</code></a>
validate: skip non-layer layers (<a
href="https://redirect.github.com/google/go-containerregistry/issues/2298">#2298</a>)</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/c29d91cdc394cb288270f4dd04a31f81054946f4"><code>c29d91c</code></a>
pkg/v1/mutate: preserve relative symlinks that stay within rootfs in
Extract ...</li>
<li><a
href="https://github.com/google/go-containerregistry/commit/a70d75a6915ed3137792206dac4bca21d1924959"><code>a70d75a</code></a>
transport: block redirects from token server to private/link-local
addresses ...</li>
<li>Additional commits viewable in <a
href="https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6">compare
view</a></li>
</ul>
</details>
<br />
Updates `gopkg.in/ini.v1` from 1.67.1 to 1.67.2
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>1 parent b6ff90f commit 819c491
2 files changed
Lines changed: 47 additions & 53 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
8 | | - | |
| 8 | + | |
9 | 9 | | |
10 | 10 | | |
11 | | - | |
12 | | - | |
| 11 | + | |
| 12 | + | |
13 | 13 | | |
14 | | - | |
| 14 | + | |
15 | 15 | | |
16 | 16 | | |
17 | 17 | | |
18 | 18 | | |
19 | | - | |
| 19 | + | |
20 | 20 | | |
21 | 21 | | |
22 | 22 | | |
| |||
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
32 | | - | |
33 | 32 | | |
34 | | - | |
| 33 | + | |
35 | 34 | | |
36 | | - | |
| 35 | + | |
37 | 36 | | |
38 | 37 | | |
39 | 38 | | |
40 | 39 | | |
41 | 40 | | |
42 | | - | |
| 41 | + | |
43 | 42 | | |
44 | 43 | | |
45 | 44 | | |
| |||
50 | 49 | | |
51 | 50 | | |
52 | 51 | | |
53 | | - | |
| 52 | + | |
| 53 | + | |
54 | 54 | | |
55 | | - | |
56 | 55 | | |
57 | 56 | | |
58 | 57 | | |
59 | | - | |
| 58 | + | |
60 | 59 | | |
61 | 60 | | |
62 | 61 | | |
63 | 62 | | |
64 | 63 | | |
65 | 64 | | |
66 | | - | |
67 | 65 | | |
68 | 66 | | |
69 | 67 | | |
70 | 68 | | |
71 | | - | |
72 | | - | |
| 69 | + | |
| 70 | + | |
73 | 71 | | |
74 | 72 | | |
75 | | - | |
76 | | - | |
| 73 | + | |
| 74 | + | |
77 | 75 | | |
78 | 76 | | |
79 | 77 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
28 | | - | |
29 | | - | |
30 | | - | |
31 | | - | |
| 28 | + | |
| 29 | + | |
32 | 30 | | |
33 | 31 | | |
34 | 32 | | |
35 | 33 | | |
36 | | - | |
37 | | - | |
| 34 | + | |
| 35 | + | |
38 | 36 | | |
39 | 37 | | |
40 | 38 | | |
| |||
45 | 43 | | |
46 | 44 | | |
47 | 45 | | |
48 | | - | |
49 | | - | |
| 46 | + | |
| 47 | + | |
50 | 48 | | |
51 | 49 | | |
52 | | - | |
53 | | - | |
| 50 | + | |
| 51 | + | |
54 | 52 | | |
55 | 53 | | |
56 | 54 | | |
| |||
65 | 63 | | |
66 | 64 | | |
67 | 65 | | |
68 | | - | |
69 | | - | |
| 66 | + | |
| 67 | + | |
70 | 68 | | |
71 | 69 | | |
72 | | - | |
73 | | - | |
| 70 | + | |
| 71 | + | |
74 | 72 | | |
75 | 73 | | |
76 | 74 | | |
| |||
80 | 78 | | |
81 | 79 | | |
82 | 80 | | |
83 | | - | |
84 | | - | |
| 81 | + | |
| 82 | + | |
85 | 83 | | |
86 | 84 | | |
87 | 85 | | |
| |||
100 | 98 | | |
101 | 99 | | |
102 | 100 | | |
103 | | - | |
104 | | - | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
105 | 105 | | |
106 | 106 | | |
107 | 107 | | |
| |||
115 | 115 | | |
116 | 116 | | |
117 | 117 | | |
118 | | - | |
119 | | - | |
120 | 118 | | |
121 | 119 | | |
122 | 120 | | |
123 | 121 | | |
124 | 122 | | |
125 | 123 | | |
126 | | - | |
127 | | - | |
| 124 | + | |
| 125 | + | |
128 | 126 | | |
129 | 127 | | |
130 | 128 | | |
| |||
154 | 152 | | |
155 | 153 | | |
156 | 154 | | |
157 | | - | |
158 | | - | |
159 | 155 | | |
160 | 156 | | |
161 | 157 | | |
| |||
170 | 166 | | |
171 | 167 | | |
172 | 168 | | |
173 | | - | |
174 | | - | |
| 169 | + | |
| 170 | + | |
175 | 171 | | |
176 | 172 | | |
177 | 173 | | |
178 | | - | |
179 | | - | |
| 174 | + | |
| 175 | + | |
180 | 176 | | |
181 | 177 | | |
182 | 178 | | |
| |||
189 | 185 | | |
190 | 186 | | |
191 | 187 | | |
192 | | - | |
193 | | - | |
| 188 | + | |
| 189 | + | |
194 | 190 | | |
195 | | - | |
196 | | - | |
| 191 | + | |
| 192 | + | |
197 | 193 | | |
198 | 194 | | |
199 | 195 | | |
200 | | - | |
201 | | - | |
| 196 | + | |
| 197 | + | |
202 | 198 | | |
203 | 199 | | |
204 | 200 | | |
| |||
207 | 203 | | |
208 | 204 | | |
209 | 205 | | |
210 | | - | |
211 | | - | |
| 206 | + | |
| 207 | + | |
212 | 208 | | |
213 | 209 | | |
214 | 210 | | |
| |||
0 commit comments