You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by GitBox <gi...@apache.org> on 2022/06/20 12:03:15 UTC
[GitHub] [dubbo-go] dependabot[bot] opened a new pull request, #1942: build(deps): bump github.com/hashicorp/vault/sdk from 0.3.0 to 0.5.2
dependabot[bot] opened a new pull request, #1942:
URL: https://github.com/apache/dubbo-go/pull/1942
Bumps [github.com/hashicorp/vault/sdk](https://github.com/hashicorp/vault) from 0.3.0 to 0.5.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/hashicorp/vault/blob/main/CHANGELOG.md">github.com/hashicorp/vault/sdk's changelog</a>.</em></p>
<blockquote>
<h2>0.5.2 (March 16th, 2016)</h2>
<p>FEATURES:</p>
<ul>
<li><strong>MSSQL Backend</strong>: Generate dynamic unique MSSQL database credentials based
on configured roles <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/998">GH-998</a></li>
<li><strong>Token Accessors</strong>: Vault now provides an accessor with each issued token.
This accessor is an identifier that can be used for a limited set of
actions, notably for token revocation. This value can be logged in
plaintext to audit logs, and in combination with the plaintext metadata
logged to audit logs, provides a searchable and straightforward way to
revoke particular users' or services' tokens in many cases. To enable
plaintext audit logging of these accessors, set <code>hmac_accessor=false</code> when
enabling an audit backend.</li>
<li><strong>Token Credential Backend Roles</strong>: Roles can now be created in the <code>token</code>
credential backend that allow modifying token behavior in ways that are not
otherwise exposed or easily delegated. This allows creating tokens with a
fixed set (or subset) of policies (rather than a subset of the calling
token's), periodic tokens with a fixed TTL but no expiration, specified
prefixes, and orphans.</li>
<li><strong>Listener Certificate Reloading</strong>: Vault's configured listeners now reload
their TLS certificate and private key when the Vault process receives a
SIGHUP.</li>
</ul>
<p>IMPROVEMENTS:</p>
<ul>
<li>auth/token: Endpoints optionally accept tokens from the HTTP body rather
than just from the URLs <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1211">GH-1211</a></li>
<li>auth/token,sys/capabilities: Added new endpoints
<code>auth/token/lookup-accessor</code>, <code>auth/token/revoke-accessor</code> and
<code>sys/capabilities-accessor</code>, which enables performing the respective actions
with just the accessor of the tokens, without having access to the actual
token <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1188">GH-1188</a></li>
<li>core: Ignore leading <code>/</code> in policy paths <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1170">GH-1170</a></li>
<li>core: Ignore leading <code>/</code> in mount paths <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1172">GH-1172</a></li>
<li>command/policy-write: Provided HCL is now validated for format violations
and provides helpful information around where the violation occurred
<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1200">GH-1200</a></li>
<li>command/server: The initial root token ID when running in <code>-dev</code> mode can
now be specified via <code>-dev-root-token-id</code> or the environment variable
<code>VAULT_DEV_ROOT_TOKEN_ID</code> <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1162">GH-1162</a></li>
<li>command/server: The listen address when running in <code>-dev</code> mode can now be
specified via <code>-dev-listen-address</code> or the environment variable
<code>VAULT_DEV_LISTEN_ADDRESS</code> <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1169">GH-1169</a></li>
<li>command/server: The configured listeners now reload their TLS
certificates/keys when Vault is SIGHUP'd <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1196">GH-1196</a></li>
<li>command/step-down: New <code>vault step-down</code> command and API endpoint to force
the targeted node to give up active status, but without sealing. The node
will wait ten seconds before attempting to grab the lock again. <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1146">GH-1146</a></li>
<li>command/token-renew: Allow no token to be passed in; use <code>renew-self</code> in</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/hashicorp/vault/commit/77f2b8a2fa408e0fc77ed7402d51cf0cfa0335d7"><code>77f2b8a</code></a> Cut version 0.5.2</li>
<li><a href="https://github.com/hashicorp/vault/commit/1a28dc823fc1b6581bd740541eeecc5c1b54a3b3"><code>1a28dc8</code></a> Remove us building Solaris binaries for the moment, as they don't build succe...</li>
<li><a href="https://github.com/hashicorp/vault/commit/d887ecbd3377e55b37a103038a167749aaeef92d"><code>d887ecb</code></a> Normalize userpass errors around bad user/pass</li>
<li><a href="https://github.com/hashicorp/vault/commit/33c2641568e38e00a86748625d400e119e45d482"><code>33c2641</code></a> Use 400 instead of 500 for failing to provide a userpass password.</li>
<li><a href="https://github.com/hashicorp/vault/commit/0676a348f37dc7dbb355890f07b918f8cffc2dd5"><code>0676a34</code></a> No need for the old Dockerfile for patched 1.5.3 anymore; it's in history if ...</li>
<li><a href="https://github.com/hashicorp/vault/commit/b9b4f458dbeadf428d5ca2536d81bca28b412034"><code>b9b4f45</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1216">#1216</a> from hashicorp/userpass-update</li>
<li><a href="https://github.com/hashicorp/vault/commit/4ae83b7cc84f59f08311e2107aa9ef4a84d7fba7"><code>4ae83b7</code></a> Add comments to existence functions</li>
<li><a href="https://github.com/hashicorp/vault/commit/2fc3c23e8dcd3be51f10835087d8de5b27278fcc"><code>2fc3c23</code></a> changelog++</li>
<li><a href="https://github.com/hashicorp/vault/commit/daab5d6777416ec443cd1ab2562e08859c1c53cd"><code>daab5d6</code></a> Fix SanitizeTTL check</li>
<li><a href="https://github.com/hashicorp/vault/commit/6f2b428379f4e490a212468c96df74521eb07d6a"><code>6f2b428</code></a> Addessing review comments</li>
<li>Additional commits viewable in <a href="https://github.com/hashicorp/vault/compare/v0.3.0...v0.5.2">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go] AlexStocks merged pull request #1942: build(deps): bump github.com/hashicorp/vault/sdk from 0.3.0 to 0.5.2
Posted by GitBox <gi...@apache.org>.
AlexStocks merged PR #1942:
URL: https://github.com/apache/dubbo-go/pull/1942
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org