Update all non-major dependencies #31

renovate · 2023-11-06T01:07:47Z

This PR contains the following updates:

Package	Update	Change
alpine_3_18/gnupg	patch	`2.4.3-r0` -> `2.4.4-r0`
alpine_3_18/jq	patch	`1.6-r3` -> `1.6-r4`
alpine_3_18/nodejs	minor	`18.18.2-r0` -> `18.20.1-r0`
alpine_3_18/openssl-dev	patch	`3.1.4-r0` -> `3.1.7-r1`
alpine_3_18/perl-utils	patch	`5.36.1-r2` -> `5.36.2-r0`
alpine_3_18/python3	patch	`3.11.6-r0` -> `3.11.11-r0`
alpine_3_18/python3-dev	patch	`3.11.6-r0` -> `3.11.11-r0`
alpine_3_18/ruby	patch	`3.2.2-r0` -> `3.2.4-r0`
alpine_3_18/ruby-dev	patch	`3.2.2-r0` -> `3.2.4-r0`
bats	minor	`1.10.0` -> `1.11.1`
debian_13/bzip2	patch	`1.0.8-5+b1` -> `1.0.8-6`
debian_13/gnupg2	patch	`2.2.40-1.1` -> `2.2.45-2`
debian_13/jq	patch	`1.7-1` -> `1.7.1-3`
debian_13/lsb-release	minor	`12.0-2` -> `12.1-1`
debian_13/python3-dev	minor	`3.11.4-5+b1` -> `3.12.6-1`
debian_13/python3-venv	minor	`3.11.4-5+b1` -> `3.12.6-1`
debian_13/ruby-full	patch	`1:3.1` -> `1:3.1+nmu1`
debian_13/wget	minor	`1.21.4-1+b1` -> `1.24.5-2`
pypi/Jinja2	patch	`3.1.2` -> `3.1.4`
pypi/checkov	minor	`3.0.14` -> `3.2.343`
pypi/requests	minor	`2.31.0` -> `2.32.3`
pypi/wheel	minor	`0.41.3` -> `0.45.1`
python	minor	`3.12.0` -> `3.13.1`
rubygems/json	minor	`2.6.3` -> `2.9.1`
snyk	minor	`1.1237.0` -> `1.1294.3`

Release Notes

bats-core/bats-core (bats)

`v1.11.1`

Compare Source

Added:

make Dockerfile compatible with #!/bin/bash files (#967)

Documentation

document bats_pipe function (#901)

Fixed:

unbreak test suites with multiple files loading common constants (#904), introduced in v1.11.0
docker image won't crash if a file or directory named 'bats' exists (#920)
use $BATS_LIBDIR instead of hardcoded lib in 'bats-gather-tests' (#985, #990)

Changed:

update Docker image with the latest bats-detik version 1.3.2 (#1017)
cleanup: remove unused $BATS_FILTER (#907)

Documentation

fix hard-coded link to readthedocs (#901)
fix tutorial code for multiline test suite (#1011)

`v1.11.0`

Compare Source

Added:

hardened CI scripts by using hashes instead of versions for actions and restricting permissions (#754, #770)
add security.md (#762)
add codespell CI checks (#720)
dynamic test registration via bats_test_function (#349)
add check that Bats is executed with Bash >= 3.2 (#873)

Fixed:

install.sh now works for deviating lib/ dirs (like lib32,lib64) (#487)
catch unset BATS_TEST_SOURCE in lib/bats-core/tracing.bash so
set -u/set -o nounset works as expected (#827)
fix --gather-test-outputs-in fails on tests with multiple / (#789)
install does not create unused /usr/share/bats anymore (#857)
ensure IFS is unchanged in {setup,teardown}{_suite,_file,}, @test and free code (#879)
junit formatter: remove ANSI Codes to avoid invalid XML character (#886)

Changed:

update Docker image with the latest bats-file version 0.4.0 (#780)
update Docker image with the latest bats-detik version 1.3.0 (#876)

Documentation

clarify docker usage (#741)
update Arch Linux package URL in installation.rst (#821)
rename bash-bats to bats for Arch Linux in installation.rst (#836)
fix FAQ entry about setup-/teardown_suite, as they are available now (#861)
added logo (#881)

snyk/snyk (snyk)

`v1.1294.3`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

security: update golang.org/x/crypto/ssh to fix a critical vulnerability

`v1.1294.2`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

container: ignore npm/yarn default cache directories
container: fix: avoid possible unhandled promise rejections

`v1.1294.1`

Compare Source

Bug Fixes

container: unable to process RedHat images when the “content_sets” attribute was missing in the redhat-content-manifests file. (https://github.com/snyk/snyk-docker-plugin/pull/615)
container: skip optional dependencies when testing Python projects to prevent "too many vulnerable paths for conversion to legacy test output" error (https://github.com/snyk/snyk-docker-plugin/pull/614)
container, test, monitor prevents "Invalid JSON" being produced when debugging is enabled and policies are being applied. (https://github.com/snyk/cli/pull/5583)

`v1.1294.0`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

News

CycloneDX 1.6 SBOM support This new version now supports generating CycloneDX 1.6 SBOMs using the snyk sbom command, providing you with more comprehensive and detailed information about your software components and their dependencies. Read more about the CycloneDX version announcement here.
Improved CLI monitoring of large Cocoapods projects When doing a snyk monitor on very large Cocoapods applications, the CLI sometimes returned an Invalid String OOM error and the operation would fail. Although this error was rare, we have fixed it so large Cocoapods applications can now be monitored successfully.
Fix for security issue The Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted (PHP|Gradle) project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk always recommends not scanning untrusted projects.

Features

sbom: add CycloneDX 1.6 SBOM support (1330fc2)
deployment: Deploy alpine arm64 binaries (9daace4)
monitor: enable cocoapods to send graphs for cli monitor (ca56c69)
iac: pass allow analytics flag to snyk-iac-test [IAC-3017] (b12d3ac)

Bug Fixes

all: restore cert file if it was externally removed (ef1547f)
auth: missing auth issue with oauth (57ae95c)
iac: upgrade iac custom rules ext to address vulns [IAC-3065] (d6cc509)
iac: upgrade snyk-iac-test to v0.55.1 [IAC-2940] (0dadc90)
monitor: add normalize help for deriving target files [CLI-448] (82efb50)
sbom: include CVE in JSON output of sbom test command (a543179)
sbom: add missing option --gradle-normalize-deps to SBOM command (151f63d)
test: default limit to max vulnerable paths per vuln, add override option --max-vulnerable-paths (302d7ac)
test: do not show test deps for Dverbose mvn with dependencyManagement (67e0de9)
test: fixed support for pnpm alias packages (d506de1)
test: point snyk policy out urls to snyk.io (28509a3)
test: scan non publishable projects on improved net (a6c0e67)
test: scan nuget with PublishSingleFile turned on (2c74298)
dependencies: update snyk-nodejs-plugin to fix micromatch vuln (baef934)
dependencies: address security vulnerability in snyk-php-plugin CVE-2024-48963 (7798d13)
dependencies: address security vulnerability in snyk-gradle-plugin CVE-2024-48964 (c614284)
dependencies: upgrade go-getter to 1.7.5 (970de96)
dependencies: upgrade iac extension and snyk-iac-test (9134c05)
dependencies: upgrade slack/webhook to 7.0.3 (8ab4433)

`v1.1293.1`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

News

Starting with this version, Snyk cli binaries will be distributed via downloads.snyk.io instead of static.snyk.io. This includes intallation from npm.

`v1.1293.0`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

News

Starting with this version, Snyk cli binaries will be distributed via downloads.snyk.io instead of static.snyk.io. This includes intallation from npm, homebrew and scoop as well as many of the CI/CD integrations.

Features

sbom: add support for license issues in sbom test (6948668)
auth: Use OAuth2 as default authentication mechanism (35949c4)
config: Introduce config environment command (0d8dd2b)
container: When docker is not installed, platform parameter is now supported (64b405d)

Bug Fixes

auth: align auth failure error messages for oauth (e3bfec3)
auth: ensure environment variable precedence for auth tokens (24417d6)
test: fix a bug related to multi-project .NET folder structures (755a38f)
test: multiple pnpm workspace improvements (da5c14f)
test: fixes a bug regarding Snyk attempting to get the dependencies from the wrong nuget *.deps.json file.(2e17434)
test: support for pipenv with python 3.12 (09df3bc)
test: support multi-part comparison for python pip versions. (b625eb9)
container: container monitor with --json now outputs valid json(039c9bd)
container: support hashing large .jar files (6f82231)
sbom: fix issues in JSON output of sbom test command, include CWE values on CWE property (#5331) (99773c3)
sbom: include all detected dep-graphs of a container image (ea43977)
iac: fixed an issue where the resource path was missing for certain Terraform resources. IAC-3015
general: map previously unhandled exit codes to exit code 2 (9fde4fe)
general: use entitlements when signing bundled macos binaries (bebc59c)

`v1.1292.4`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Complete changelog

Bug Fixes

deployment: Rollback of digital signature for the bundled macOS binary (#5416)

`v1.1292.3`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Complete changelog

Bug Fixes

deployment: Add digital signature for the bundled macOS binary
(#5404)

`v1.1292.2`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Complete changelog

Bug Fixes

container test: Improve the accuracy of identifying npm projects within docker images by removing the explicit folder ignore rules
(#5384)
container test: Pass platform parameter when pulling an image from a container registry (#5360)

`v1.1292.1`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Complete changelog

Bug Fixes

test,monitor: fix improper permission error handling when accessing 'enablePnpmCli' feature flag

`v1.1292.0`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

News

This Snyk CLI release delivers an assortment of bug fixes and improvements.

We've added support for pnpm, giving you more flexibility in your project setup.
You can now scan npm/yarn projects even without lockfiles, ensuring comprehensive vulnerability detection regardless of your dependency management approach.
We're committed to strengthening security. This release includes redaction of additional sensitive data in debug logs, minimizing potential risks.

Complete changelog

Features

test: Added pnpm support under 'enablePnpmCli' feature flag (#5181) (46769cc)
test: Support scan of npm/yarn projects without lockfiles (e2d77a9)
monitor: Set target-reference in the monitor request (51ed8f5)
code: Centrally check if code test is enabled (#5239) (e5a00e2)
sbom: Improve depgraph for Maven projects (fbb33d7)
sbom: Use RFC 3339 for all timestamps in sbom test result (#5204) (91bf191)
language-server: Add --all-projects flag scans by default#5247k/snyk/issues/5247)) (fdcf30e)
language-server: Enable incremental scanning#5291k/snyk/issues/5291)) (d198685)
language-server: Add support for IDE themes (c1c4d08)
language-server: Consistent styling across intellij and vscode (#5282) (9aa6f76)
logging: Redact additional types of sensitive data from debug logs (#5254) (056cdab)

Bug Fixes

auth: Autodetect IDE usage and fallback to API token based authentication (#5241) (4c795e0)
iac: Upgrade iac custom rules to address Vulnerabilities#5191yk/snyk/issues/5191)) (453db24)
language-server: Caching problem when no vulnerabilities in the IDE (#5223) (89c9491)
language-server: Remove incorrect /v1 path (#5214) (cf16470)
dependencies: Update dependencies to reduce vulnerabilities (#5131) (4c7cb3c)
sbom: sbom test output padding (e3b7cac)
sbom: Fix container purl generation for apt and rpm (#5207) (fa9d512)
sbom: Retain error code during SBOM generation (#5202) (5e98aaa)
test: support cyclic dependencies in maven with dverbose (#5208) (fb24c02)
test: Add tool version and informationUri to sarif output (#5203) (b899fd3)
test: fixing several .NET bugs (#5217) (c27d767)
test: fixing a bug causing .NET beta scanning to fail on older versions of .NET (#5228) (5fdecf7)
test: .NET runtime resolution testing now supports projects targeting .NET Standard frameworks (#5169) (44d0861)
test: fix issues of type 'Cannot find module ...' in snyk-docker-plugin (#5301) (88efd54)
monitor: fix project name when using assets-project-name flag (#5077) (57dc718)

`v1.1291.1`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

dependencies: Upgrade go-getter to v1.7.4 to fix vulnerabilities (#5252)

`v1.1291.0`

Compare Source

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

News

This is the first stable release of the CLI
It makes use of semantic versioning and is the successor of 1.1290.0

Bug Fixes

test: Fix support of cyclic dependencies in maven with dverbose #5208

`v1.1290.0`

Compare Source

Bug Fixes

code: Fix error handling for experimental go native code client (#5170) (5400c69)

Features

code: introduce human readable formatting for experimental test mechanism (#5174) (34bbc95)
sbom: Introduce experimental sbom test command (#5176) (ea6293b)
snyk woof ro language support and tests (#5166) (ed2e754)

`v1.1289.0`

Compare Source

Bug Fixes

ls: Trigger re-analysis after fixing interfile issues (#5163) (05cb9f5)

Features

code: Integrate experimental go native code client [CLI-224] (#5164) (5bd898e)
include additional policy properties, when provided, in plain text output (#5142) (a8be764)
use workflow data to determine exit code errors (51c717b)

`v1.1288.1`

Compare Source

Bug Fixes

iac: Fix Issue Path in human readable and json output [IAC-2935] (#5159) (5fc3d59)

`v1.1288.0`

Compare Source

Bug Fixes

add --experimental flag for snyk code test (#5151) (08647f2)
make download of CLI in language server more resilient under windows [IDE-90] (#5155) (1e51948)

Features

bump language server protocol version to 11 [IDE-236] (#5156) (fc41937)

`v1.1287.0`

Compare Source

Features

upgrade snyk-iac-test to v0.51.3 (#5127) (0fd8fa6)

`v1.1286.4`

Compare Source

Bug Fixes

upgrade iac custom rules extension to address vulns [IAC-2921] (#5149) (6b96473)

`v1.1286.3`

Compare Source

Bug Fixes

always finish progress when auto-fixing in language server (#5145) (f645bbe)
avoid potentially outputting very large JSON objects (#5147) (84b5e8b)

`v1.1286.2`

Compare Source

Bug Fixes

enhance sbt output width, fixing false positives vulns (#5130) (2011b90)

`v1.1286.1`

Compare Source

Bug Fixes

Fix error in sbom command when using --json-file-output (#5136) (eee1ec5)

`v1.1286.0`

Compare Source

Features

support CycloneDX v1.5 (#5123) (b22b166)

`v1.1285.1`

Compare Source

Bug Fixes

ci: add missing node types (#5129) (c55af61)
Fix handling of large json data when using --json [CLI-73] (#5093) (c0d401c)

`v1.1285.0`

Compare Source

Features

language-server: Added command to retrieve fix suggestions for snyk code
language-server: Added Feature Flag command
language-server: Associate learn lessons with all specified ecosystems

`v1.1284.0`

Compare Source

Features

support -dverbose argument when testing maven projects #5117 (1ef091f)

`v1.1283.1`

Compare Source

Bug Fixes

ci: End to end test by updating to a newer test image (#5115) (93b4fcb)
fix add support for dev/alpha/beta/rc python versions (#5106) (bd6351a), closes #5108 #5107

`v1.1283.0`

Compare Source

Features

add python optional dependencies support (#5072) (e52fdaa)

`v1.1282.1`

Compare Source

Bug Fixes

ci: upgrade slack webhook (#5085) (9f4d512)
danger: commit pattern in danger to disable certain characters (#5089) (2113022)
enforce correct type for security-severity in sarif output (#5091) (f0c8339)
remove dependencies when parent folder is deleted (#5080) (4f892f7)

`v1.1282.0`

Compare Source

Bug Fixes

enables multi-platform support for OCI images (#5082) (00af20b)

Features

populate CVSS scores in SARIF files (#5014) (#5088) (54253f7)

`v1.1281.0`

Compare Source

Bug Fixes

do not purge the code action cache in language server before the action is resolved by the client [IDE-134] (#5062) (4bf4333)
support monitoring larger/complex container projects (#5075) (091e277)
upgrade go toolchain to 1.21.7 (#5064) (f282bb5)

Features

add dataflow to code issue data [IDE-134] (#5076) (6545bec)
provide easy way to update snyk-ls in CLI [IDE-144] (#5067) (e9723af)

`v1.1280.1`

Compare Source

Bug Fixes

add range to snyk.scan message create by code scanner [IDE-134] (#5052) (e78bad6)
Scanning of .NET projects with the --dotnet-runtime-resolution flag now uses existing NuGet package cache if available (#5051) (023f633)

`v1.1280.0`

Compare Source

Bug Fixes

improved 'npm dist-tags' handling for npm lockfile v2 and newer (#5033) (8d0d96a)

`v1.1279.0`

Compare Source

Bug Fixes

allow docker.io as a registry base for container commands (#5049) (2b3c776)
increase max allocatable heap memory to 32GB (#5043) (41c0c03)

Features

Deploy regular CLI builds to a new preview channel (#5042) (d5e65e8)

`v1.1278.0`

Compare Source

Bug Fixes

Fix circular dependencies errors for python packages (#5032) (85616d4)

Features

Support for custom output paths for dotnet v2 projects [OSM-955] ([#5015](https://redirect.github.com/snyk/snyk/issues/5

Configuration

📅 Schedule: Branch creation - "* 0-3 * * 1" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 5d115c0 to f675d77 Compare November 12, 2023 18:14

renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 08fdf32 to bbc1fdd Compare November 16, 2023 17:37

renovate bot force-pushed the renovate/all-minor-patch branch 14 times, most recently from 6f7f0b3 to c03eecf Compare November 27, 2023 10:54

renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from d5a7ab6 to f6432f3 Compare November 28, 2023 21:59

renovate bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from bf68a31 to d248bd1 Compare December 1, 2024 13:32

renovate bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from ef8ca9c to ba6f92d Compare December 8, 2024 17:06

renovate bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 4526c1f to 30b6e48 Compare December 18, 2024 22:36

Update all non-major dependencies

70436db

renovate bot force-pushed the renovate/all-minor-patch branch from 30b6e48 to 70436db Compare December 19, 2024 20:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update all non-major dependencies #31

Update all non-major dependencies #31

renovate bot commented Nov 6, 2023 •

edited

Loading

Update all non-major dependencies #31

Are you sure you want to change the base?

Update all non-major dependencies #31

Conversation

renovate bot commented Nov 6, 2023 • edited Loading

Release Notes

Added:

Documentation

Fixed:

Changed:

Documentation

Added:

Fixed:

Changed:

Documentation

Bug Fixes

Bug Fixes

Bug Fixes

News

Features

Bug Fixes

News

News

Features

Bug Fixes

Complete changelog

Bug Fixes

Complete changelog

Bug Fixes

Complete changelog

Bug Fixes

Complete changelog

Bug Fixes

News

Complete changelog

Features

Bug Fixes

Bug Fixes

News

Bug Fixes

Bug Fixes

Features

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Features

Features

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Features

Configuration

renovate bot commented Nov 6, 2023 •

edited

Loading