Skip to content
This repository has been archived by the owner on Jan 23, 2025. It is now read-only.

chore(deps): bump github.com/open-policy-agent/opa from 0.60.0 to 0.62.1 #1538

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 11, 2024

Bumps github.com/open-policy-agent/opa from 0.60.0 to 0.62.1.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v0.62.1

This is a security fix release for the fixes published in Go 1.22.1.

OPA servers using --authentication=tls would be affected: crafted malicious client certificates could cause a panic in the server.

Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin, status and decision logs; and http.send calls that verify TLS.

This is CVE-2024-24783 (https://pkg.go.dev/vuln/GO-2024-2598).

Note that there are other security fixes in this Golang release, but whether or not OPA is affected is harder to assess. An update is advised.

Miscellaneous

v0.62.0

NOTES:

  • The minimum version of Go required to build the OPA module is 1.20

This release contains a mix of improvements and bugfixes.

Runtime, Tooling, SDK

  • cmd: Add environment variable backups for command-line flags (#6508) authored by @​colinjlacy
  • download/oci: Add missing WithBundleParserOpts method to OCI downloader (#6571) authored by @​slonka
  • logging: avoid %!F(MISSING) in logs by skipping calls to the {Debug,Info,Warn,Error}f functions when there are no arguments (#6555) authored by @​srenatus

Topdown and Rego

Docs + Website + Ecosystem

  • Add OpaDotNet to ecosystem projects (#6554) authored by @​me-viper
  • Add updated logos for Permit.io and OPAL (#6562) authored by @​danielbass37
  • docs: Update description of the url path usage when accessing values inside object and array documents for v1/data GET and POST (#6567) authored by @​ashutosh-narkar
  • docs: Use application/yaml instead of application/x-yaml as the former is now a recognized content type (#6565) authored by @​anderseknert

Miscellaneous

  • Add Elastic to ADOPTERS.md (#6568) authored by @​orouz
  • Dependency updates; notably:
    • bump golang 1.21.5 -> 1.22 (#6595) authored by @​srenatus
    • bump google.golang.org/grpc from 1.61.0 to 1.62.0
    • bump golang.org/x/net from 0.19.0 to 0.21.0

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

0.62.1

This is a security fix release for the fixes published in Golang 1.22.1.

OPA servers using --authentication=tls would be affected: crafted malicious client certificates could cause a panic in the server.

Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin, status and decision logs; and http.send calls that verify TLS.

This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

This is CVE-2024-24783 (https://pkg.go.dev/vuln/GO-2024-2598).

Note that there are other security fixes in this Golang release, but whether or not OPA is affected is harder to tell. An update is advised.

Miscellaneous

0.62.0

NOTES:

  • The minimum version of Go required to build the OPA module is 1.20

This release contains a mix of improvements and bugfixes.

Runtime, Tooling, SDK

  • cmd: Add environment variable backups for command-line flags (#6508) authored by @​colinjlacy
  • download/oci: Add missing WithBundleParserOpts method to OCI downloader (#6571) authored by @​slonka
  • logging: avoid %!F(MISSING) in logs by skipping calls to the {Debug,Info,Warn,Error}f functions when there are no arguments (#6555) authored by @​srenatus

Topdown and Rego

Docs + Website + Ecosystem

  • Add OpaDotNet to ecosystem projects (#6554) authored by @​me-viper
  • Add updated logos for Permit.io and OPAL (#6562) authored by @​danielbass37
  • docs: Update description of the url path usage when accessing values inside object and array documents for v1/data GET and POST (#6567) authored by @​ashutosh-narkar

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.60.0 to 0.62.1.
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v0.60.0...v0.62.1)

---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/opa
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from simar7 as a code owner March 11, 2024 00:44
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 11, 2024
Copy link
Contributor Author

dependabot bot commented on behalf of github Apr 1, 2024

Superseded by #1540.

@dependabot dependabot bot closed this Apr 1, 2024
@dependabot dependabot bot deleted the dependabot/go_modules/github.com/open-policy-agent/opa-0.62.1 branch April 1, 2024 00:27
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants