consul

Commit Graph

Author	SHA1	Message	Date
Michael Zalimeni	86b0818c1f	[NET-8601] security: upgrade vault/api to remove go-jose.v2 (#20910 ) security: upgrade vault/api to remove go-jose.v2 This dependency has an open vulnerability (GO-2024-2631), and is no longer needed by the latest `vault/api`. This is a follow-up to the upgrade of `go-jose/v3` in this repository to make all our dependencies consolidate on v3. Also remove the recently added security scan triage block for GO-2024-2631, which was added due to incorrect reports that `go-jose/v3@3.0.3` was impacted; in reality, is was this indirect client dependency (not impacted by CVE) that the scanner was flagging. A bug report has been filed to address the incorrect reporting.	7 months ago
Deniz Onur Duzgun	8209b3ff86	security: fine-tune release scanner and bump coredns (#21038 ) * security: bump coredns * add changelog * Revert "security: bump coredns" This reverts commit `dcca09d83e`. * security: bump coredns * fine-tune security scanner on release * dismiss changelog	7 months ago
John Murret	d261a987f1	update go-control-plane envoy dependency to 0.12.0 (#20973 ) * update go-control-plane envoy dependency to 0.12.0 * add changelog * go mod tidy * fix linting issues * add agent/grpc-internal to the list of SA1019 ignores	8 months ago
Deniz Onur Duzgun	3152ac3702	security: bump go, x/net and envoy versions (#20956 ) * Bump go version * Bump x/net * Bump envoy version * Add changelog --------- Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	8 months ago
Michael Zalimeni	d4761c0ccd	security: upgrade google.golang.org/protobuf to 1.33.0 (#20801 ) Resolves CVE-2024-24786.	9 months ago
Michael Zalimeni	fe10339caa	[NET-7009] security: update x/crypto to 0.17.0 (#20023 ) security: update x/crypto to 0.17.0 This addresses CVE-2023-48795 (x/crypto/ssh).	11 months ago
Michael Zalimeni	42647de35d	[NET-6138] security: Bump `google.golang.org/grpc` to 1.56.3 (CVE-2023-44487) (#19414 ) Bump google.golang.org/grpc to 1.56.3 This resolves [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487). Co-authored-by: Chris Thain <chris.m.thain@gmail.com>	1 year ago
Michael Zalimeni	8eb074e7c1	[NET-5944] security: Update Go version to 1.20.10 and `x/net` to 0.17.0 (#19225 ) * Bump golang.org/x/net to 0.17.0 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487). * Update Go version to 1.20.10 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) (`net/http`).	1 year ago
hashicorp-copywrite[bot]	5fb9df1640	[COMPLIANCE] License changes (#18443 ) * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * add missing license headers * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	1 year ago
Michael Zalimeni	905e371607	[NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358 ) * Update Go version to 1.20.7 This resolves [CVE-2023-29409] (https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`). * Bump golang.org/x/net to 0.13.0 Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) for security scans (non-impacting).	1 year ago
Matt Keeler	77f44fa878	Various bits of cleanup detected when using Go Workspaces (#17462 ) TLDR with many modules the versions included in each diverged quite a bit. Attempting to use Go Workspaces produces a bunch of errors. This commit: 1. Fixes envoy-library-references.sh to work again 2. Ensures we are pulling in go-control-plane@v0.11.0 everywhere (previously it was at that version in some modules and others were much older) 3. Remove one usage of golang/protobuf that caused us to have a direct dependency on it. 4. Remove deprecated usage of the Endpoint field in the grpc resolver.Target struct. The current version of grpc (v1.55.0) has removed that field and recommended replacement with URL.Opaque and calls to the Endpoint() func when needing to consume the previous field. 4. `go work init <all the paths to go.mod files>` && `go work sync`. This syncrhonized versions of dependencies from the main workspace/root module to all submodules 5. Updated .gitignore to ignore the go.work and go.work.sum files. This seems to be standard practice at the moment. 6. Update doc comments in protoc-gen-consul-rate-limit to be go fmt compatible 7. Upgraded makefile infra to perform linting, testing and go mod tidy on all modules in a flexible manner. 8. Updated linter rules to prevent usage of golang/protobuf 9. Updated a leader peering test to account for an extra colon in a grpc error message.	1 year ago
hashicorp-copywrite[bot]	9f81fc01e9	[COMPLIANCE] Add Copyright and License Headers (#16854 ) Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com>	2 years ago
Nick Irvine	32358ddf7e	port ENT ingress gateway upgrade tests [NET-2294] [NET-2296] (#16804 )	2 years ago
Ronald	b64674623e	Copyright headers for missing files/folders (#16708 ) * copyright headers for agent folder	2 years ago
Kyle Schochenmaier	bf0f61a878	removes ioutil usage everywhere which was deprecated in go1.16 (#15297 ) * update go version to 1.18 for api and sdk, go mod tidy * removes ioutil usage everywhere which was deprecated in go1.16 in favour of io and os packages. Also introduces a lint rule which forbids use of ioutil going forward. Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	2 years ago
Paul Banks	ab27214a10	Minor improvements to SDS server from review	3 years ago
Paul Banks	e01c3585a5	Fix integration tests in CI - serve SDS certs from the Docker image not a mounted path	3 years ago
Paul Banks	cd8ad007fe	Add basic integration test for Envoy ingress with SDS	3 years ago

18 Commits (jm/ent-deps)