You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by GitBox <gi...@apache.org> on 2022/12/26 12:01:13 UTC
[GitHub] [dubbo-go] dependabot[bot] opened a new pull request, #2169: build(deps): bump github.com/hashicorp/vault/sdk from 0.6.0 to 0.6.2
dependabot[bot] opened a new pull request, #2169:
URL: https://github.com/apache/dubbo-go/pull/2169
Bumps [github.com/hashicorp/vault/sdk](https://github.com/hashicorp/vault) from 0.6.0 to 0.6.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/hashicorp/vault/blob/main/CHANGELOG.md">github.com/hashicorp/vault/sdk's changelog</a>.</em></p>
<blockquote>
<h2>0.6.2 (October 5, 2016)</h2>
<p>DEPRECATIONS/CHANGES:</p>
<ul>
<li>Convergent Encryption v2: New keys in <code>transit</code> using convergent mode will
use a new nonce derivation mechanism rather than require the user to supply
a nonce. While not explicitly increasing security, it minimizes the
likelihood that a user will use the mode improperly and impact the security
of their keys. Keys in convergent mode that were created in v0.6.1 will
continue to work with the same mechanism (user-supplied nonce).</li>
<li><code>etcd</code> HA off by default: Following in the footsteps of <code>dynamodb</code>, the
<code>etcd</code> storage backend now requires that <code>ha_enabled</code> be explicitly
specified in the configuration file. The backend currently has known broken
HA behavior, so this flag discourages use by default without explicitly
enabling it. If you are using this functionality, when upgrading, you should
set <code>ha_enabled</code> to <code>"true"</code> <em>before</em> starting the new versions of Vault.</li>
<li>Default/Max lease/token TTLs are now 32 days: In previous versions of Vault
the default was 30 days, but moving it to 32 days allows some operations
(e.g. reauthenticating, renewing, etc.) to be performed via a monthly cron
job.</li>
<li>AppRole Secret ID endpoints changed: Secret ID and Secret ID accessors are
no longer part of request URLs. The GET and DELETE operations are now moved
to new endpoints (<code>/lookup</code> and <code>/destroy</code>) which consumes the input from
the body and not the URL.</li>
<li>AppRole requires at least one constraint: previously it was sufficient to
turn off all AppRole authentication constraints (secret ID, CIDR block) and
use the role ID only. It is now required that at least one additional
constraint is enabled. Existing roles are unaffected, but any new roles or
updated roles will require this.</li>
<li>Reading wrapped responses from <code>cubbyhole/response</code> is deprecated. The
<code>sys/wrapping/unwrap</code> endpoint should be used instead as it provides
additional security, auditing, and other benefits. The ability to read
directly will be removed in a future release.</li>
<li>Request Forwarding is now on by default: in 0.6.1 this required toggling on,
but is now enabled by default. This can be disabled via the
<code>"disable_clustering"</code> parameter in Vault's
<a href="https://www.vaultproject.io/docs/config/index.html">config</a>, or per-request
with the <code>X-Vault-No-Request-Forwarding</code> header.</li>
<li>In prior versions a bug caused the <code>bound_iam_role_arn</code> value in the
<code>aws-ec2</code> authentication backend to actually use the instance profile ARN.
This has been corrected, but as a result there is a behavior change. To
match using the instance profile ARN, a new parameter
<code>bound_iam_instance_profile_arn</code> has been added. Existing roles will
automatically transfer the value over to the correct parameter, but the next
time the role is updated, the new meanings will take effect.</li>
</ul>
<p>FEATURES:</p>
<ul>
<li><strong>Secret ID CIDR Restrictions in <code>AppRole</code></strong>: Secret IDs generated under an
approle can now specify a list of CIDR blocks from where the requests to</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/hashicorp/vault/commit/22619b6786724c8eca5340a63395bf3058e1e3f7"><code>22619b6</code></a> Cut version 0.6.2</li>
<li><a href="https://github.com/hashicorp/vault/commit/d7615b04779864c13df5938a25f780070036ce00"><code>d7615b0</code></a> Don't use quoted identifier for the username</li>
<li><a href="https://github.com/hashicorp/vault/commit/f911375ca4795e9cea5fe9d4dc0a66dba32d92c9"><code>f911375</code></a> Update upgrade guide</li>
<li><a href="https://github.com/hashicorp/vault/commit/9c30bf07e5dfa3f677a2a0d1c685d4a88402c0d9"><code>9c30bf0</code></a> changelog++</li>
<li><a href="https://github.com/hashicorp/vault/commit/37df43d534e9d8757a41fb87890ea8a30badaae1"><code>37df43d</code></a> Postgres revocation sql, beta mode (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1972">#1972</a>)</li>
<li><a href="https://github.com/hashicorp/vault/commit/5394fc77e0de5f84cf07dabd332d89e3d0d06e04"><code>5394fc7</code></a> Prep for 0.6.2</li>
<li><a href="https://github.com/hashicorp/vault/commit/261cc52cbc81abe7d09bee0bbd76416470af90ee"><code>261cc52</code></a> Post-review fixes for file/zk recursive empty prefix delete</li>
<li><a href="https://github.com/hashicorp/vault/commit/2af3c499bf6769442a5d78dbc387fd4a17825287"><code>2af3c49</code></a> changelog++</li>
<li><a href="https://github.com/hashicorp/vault/commit/fd234e4c9a261b86e69053dd299b927f58b50f41"><code>fd234e4</code></a> changelog++</li>
<li><a href="https://github.com/hashicorp/vault/commit/2711249e08a2448be4b58a1734630c549884c4a8"><code>2711249</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1964">#1964</a> from mesosphere/prozlach/nested_secrets_handling_fix</li>
<li>Additional commits viewable in <a href="https://github.com/hashicorp/vault/compare/v0.6.0...v0.6.2">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go] codecov-commenter commented on pull request #2169: build(deps): bump github.com/hashicorp/vault/sdk from 0.6.0 to 0.6.2
Posted by GitBox <gi...@apache.org>.
codecov-commenter commented on PR #2169:
URL: https://github.com/apache/dubbo-go/pull/2169#issuecomment-1365132896
# [Codecov](https://codecov.io/gh/apache/dubbo-go/pull/2169?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#2169](https://codecov.io/gh/apache/dubbo-go/pull/2169?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (8c1a40c) into [3.0](https://codecov.io/gh/apache/dubbo-go/commit/169a5a081700fc7f89e73b3d49e7bf0f51c10b97?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (169a5a0) will **increase** coverage by `0.07%`.
> The diff coverage is `n/a`.
```diff
@@ Coverage Diff @@
## 3.0 #2169 +/- ##
==========================================
+ Coverage 44.25% 44.32% +0.07%
==========================================
Files 283 283
Lines 17109 17109
==========================================
+ Hits 7571 7584 +13
+ Misses 8744 8729 -15
- Partials 794 796 +2
```
| [Impacted Files](https://codecov.io/gh/apache/dubbo-go/pull/2169?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) | Coverage Δ | |
|---|---|---|
| [metadata/report/delegate/delegate\_report.go](https://codecov.io/gh/apache/dubbo-go/pull/2169/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-bWV0YWRhdGEvcmVwb3J0L2RlbGVnYXRlL2RlbGVnYXRlX3JlcG9ydC5nbw==) | `35.09% <0.00%> (+8.60%)` | :arrow_up: |
:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go] sonarcloud[bot] commented on pull request #2169: build(deps): bump github.com/hashicorp/vault/sdk from 0.6.0 to 0.6.2
Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #2169:
URL: https://github.com/apache/dubbo-go/pull/2169#issuecomment-1365120938
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_dubbo-go&pullRequest=2169)
[](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=apache_dubbo-go&pullRequest=2169&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_dubbo-go&pullRequest=2169) No Coverage information
[](https://sonarcloud.io/component_measures?id=apache_dubbo-go&pullRequest=2169&metric=duplicated_lines_density&view=list) No Duplication information
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go] AlexStocks merged pull request #2169: build(deps): bump github.com/hashicorp/vault/sdk from 0.6.0 to 0.6.2
Posted by GitBox <gi...@apache.org>.
AlexStocks merged PR #2169:
URL: https://github.com/apache/dubbo-go/pull/2169
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org