Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): Bump the production-dependencies group across 1 directory with 9 updates #414

Merged

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github May 29, 2024

Bumps the production-dependencies group with 7 updates in the / directory:

Package From To
github.com/tektoncd/pipeline 0.59.0 0.60.1
cloud.google.com/go/iam 1.1.7 1.1.8
github.com/docker/docker-credential-helpers 0.8.1 0.8.2
github.com/emicklei/go-restful/v3 3.12.0 3.12.1
github.com/go-logr/logr 1.4.1 1.4.2
github.com/sigstore/sigstore 1.8.3 1.8.4
google.golang.org/api 0.181.0 0.182.0

Updates github.com/tektoncd/pipeline from 0.59.0 to 0.60.1

Release notes

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v0.60.1 "Chinchilla Tobor"

-Docs @ v0.60.1 -Examples @ v0.60.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.60.1/release.yaml

Attestation

The Rekor UUID for this release is 24296fb24b8ad77a3c629b9f100be0eec857bdac47e80bdeacaf4cebba95adb7f9918b91b27842c5

Obtain the attestation:

REKOR_UUID=24296fb24b8ad77a3c629b9f100be0eec857bdac47e80bdeacaf4cebba95adb7f9918b91b27842c5
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.60.1/release.yaml
REKOR_UUID=24296fb24b8ad77a3c629b9f100be0eec857bdac47e80bdeacaf4cebba95adb7f9918b91b27842c5
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.60.1@sha256:" + .digest.sha256')
Download the release file
curl "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

... (truncated)

Changelog

Sourced from github.com/tektoncd/pipeline's changelog.

Tekton Pipeline Releases

Release Frequency

Tekton Pipelines follows the Tekton community [release policy][release-policy] as follows:

  • Versions are numbered according to semantic versioning: vX.Y.Z
  • A new release is produced on a monthly basis
  • Four releases a year are chosen for long term support (LTS). All remaining releases are supported for approximately 1 month (until the next release is produced)
    • LTS releases take place in January, April, July and October every year
    • The first Tekton Pipelines LTS release will be v0.41.0 in October 2022
    • Releases happen towards the middle of the month, between the 13th and the 20th, depending on week-ends and readiness

Tekton Pipelines produces nightly builds, publicly available on gcr.io/tekton-nightly.

Transition Process

Before release v0.41 Tekton Pipelines has worked on the basis of an undocumented support period of four months, which will be maintained for the releases between v0.37 and v0.40.

Release Process

Tekton Pipeline releases are made of YAML manifests and container images. Manifests are published to cloud object-storage as well as [GitHub][tekton-pipeline-releases]. Container images are signed by [Sigstore][sigstore] via [Tekton Chains][tekton-chains]; signatures can be verified through the [public key][chains-public-key] hosted by the Tekton Chains project.

Further documentation available:

  • The Tekton Pipeline [release process][tekton-releases-docs]
  • [Installing Tekton][tekton-installation]
  • Standard for [release notes][release-notes-standards]

Release

v0.60

  • Latest Release: [v0.60.1][v0.60-1] (2024-05-28) ([docs][v0.60-1-docs], [examples][v0.60-1-examples])
  • Initial Release: [v0.60.0][v0.60-0] (2024-05-22)
  • End of Life: 2024-06-22
  • Patch Releases: [v0.60.0][v0.60-0], [v0.60.1][v0.60-1]

v0.59 (LTS)

... (truncated)

Commits

Updates cloud.google.com/go/iam from 1.1.7 to 1.1.8

Commits
  • b1c9263 chore: release main (#10004)
  • a03bd0e chore(spanner): update Spanner owner to harshachinta (#10060)
  • 7e8600a chore(all): update deps (#10058)
  • daea9d1 chore(deps): ignore go.opentelemetry.io/contrib/detectors/gcp (#10077)
  • 59457a3 feat(shopping): new shopping.merchant.conversions client (#10076)
  • e82cc5f feat(streetview): new client(s) (#10075)
  • 7656129 feat(aiplatform): A new value TPU_V5_LITEPOD is added to enum `AcceleratorT...
  • f537fdd chore: generate streetview publish client (#10072)
  • 1d757c6 docs(batch): Update description on allowed_locations in LocationPolicy field ...
  • bb47185 chore(spanner): temporarily skip spanner tests (#10071)
  • Additional commits viewable in compare view

Updates github.com/docker/docker-credential-helpers from 0.8.1 to 0.8.2

Release notes

Sourced from github.com/docker/docker-credential-helpers's releases.

v0.8.2

What's Changed

Full Changelog: docker/docker-credential-helpers@v0.8.1...v0.8.2

Commits
  • 6b9df3e Merge pull request #323 from thaJeztah/pass_simplify_get
  • dc10c50 Merge pull request #317 from docker/dependabot/github_actions/softprops/actio...
  • 896eb37 build(deps): bump softprops/action-gh-release to 2.0.5
  • a14669f pass: Get: remove redundant stat
  • 74840b3 Merge pull request #322 from thaJeztah/pass_dry
  • d3ef442 pass: add utilities for encoding/decoding serverURL
  • f64d6b1 Merge pull request #321 from thaJeztah/fix_pass_errors
  • 1bb9aa3 pass: return correct error, and ignore empty stores on list
  • 73b9e5d Merge pull request #320 from thaJeztah/update_gha
  • 0c43fed update to go1.21.10
  • Additional commits viewable in compare view

Updates github.com/emicklei/go-restful/v3 from 3.12.0 to 3.12.1

Changelog

Sourced from github.com/emicklei/go-restful/v3's changelog.

[v3.12.1] - 2024-05-28

  • fix misroute when dealing multiple webservice with regex (#549) (thanks Haitao Chen)
Commits

Updates github.com/go-logr/logr from 1.4.1 to 1.4.2

Release notes

Sourced from github.com/go-logr/logr's releases.

v1.4.2

What's Changed

Dependencies:

Full Changelog: go-logr/logr@v1.4.1...v1.4.2

Commits
  • 1205f42 Merge pull request #295 from go-logr/dependabot/github_actions/actions/checko...
  • ccedcbd Merge pull request #294 from go-logr/dependabot/github_actions/github/codeql-...
  • bead577 build(deps): bump actions/checkout from 4.1.5 to 4.1.6
  • a492d95 build(deps): bump github/codeql-action from 3.25.4 to 3.25.5
  • 19ad07c build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3
  • 1c97a21 build(deps): bump actions/checkout from 4.1.4 to 4.1.5
  • f70c5b5 build(deps): bump github/codeql-action from 3.25.3 to 3.25.4
  • 4ade8d3 build(deps): bump golangci/golangci-lint-action from 5.3.0 to 6.0.1
  • 88d98bd Merge pull request #289 from go-logr/dependabot/github_actions/golangci/golan...
  • 432cd86 Merge pull request #288 from go-logr/dependabot/github_actions/actions/setup-...
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.8.3 to 1.8.4

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.8.4

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.8.3...v1.8.4

Commits
  • 5cd937f build(deps): Bump github.com/hashicorp/vault/api
  • 96fc144 build(deps): Bump the all group in /pkg/signature/kms/gcp with 2 updates
  • 2b99005 build(deps): Bump the all group in /pkg/signature/kms/aws with 3 updates
  • fa5d64b sync go mod
  • 186a1e5 build(deps): Bump the all group across 1 directory with 4 updates
  • 1ba2030 Fix Hashicorp Vault KMS to use PKCS1 v1.5
  • ec88c0b ---
  • bbe51a7 ---
  • 1d8a874 ---
  • acb4db4 build(deps): Bump golangci/golangci-lint-action from 5.3.0 to 6.0.1
  • Additional commits viewable in compare view

Updates google.golang.org/api from 0.181.0 to 0.182.0

Release notes

Sourced from google.golang.org/api's releases.

v0.182.0

0.182.0 (2024-05-28)

Features

Changelog

Sourced from google.golang.org/api's changelog.

0.182.0 (2024-05-28)

Features

Commits

Updates google.golang.org/genproto/googleapis/api from 0.0.0-20240513163218-0867130af1f8 to 0.0.0-20240520151616-dc85e6b867a5

Commits

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20240513163218-0867130af1f8 to 0.0.0-20240521202816-d264139d666e

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 9 updates

Bumps the production-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/tektoncd/pipeline](https://github.com/tektoncd/pipeline) | `0.59.0` | `0.60.1` |
| [cloud.google.com/go/iam](https://github.com/googleapis/google-cloud-go) | `1.1.7` | `1.1.8` |
| [github.com/docker/docker-credential-helpers](https://github.com/docker/docker-credential-helpers) | `0.8.1` | `0.8.2` |
| [github.com/emicklei/go-restful/v3](https://github.com/emicklei/go-restful) | `3.12.0` | `3.12.1` |
| [github.com/go-logr/logr](https://github.com/go-logr/logr) | `1.4.1` | `1.4.2` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.8.3` | `1.8.4` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.181.0` | `0.182.0` |



Updates `github.com/tektoncd/pipeline` from 0.59.0 to 0.60.1
- [Release notes](https://github.com/tektoncd/pipeline/releases)
- [Changelog](https://github.com/tektoncd/pipeline/blob/main/releases.md)
- [Commits](tektoncd/pipeline@v0.59.0...v0.60.1)

Updates `cloud.google.com/go/iam` from 1.1.7 to 1.1.8
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@iam/v1.1.7...iam/v1.1.8)

Updates `github.com/docker/docker-credential-helpers` from 0.8.1 to 0.8.2
- [Release notes](https://github.com/docker/docker-credential-helpers/releases)
- [Commits](docker/docker-credential-helpers@v0.8.1...v0.8.2)

Updates `github.com/emicklei/go-restful/v3` from 3.12.0 to 3.12.1
- [Release notes](https://github.com/emicklei/go-restful/releases)
- [Changelog](https://github.com/emicklei/go-restful/blob/v3/CHANGES.md)
- [Commits](emicklei/go-restful@v3.12.0...v3.12.1)

Updates `github.com/go-logr/logr` from 1.4.1 to 1.4.2
- [Release notes](https://github.com/go-logr/logr/releases)
- [Changelog](https://github.com/go-logr/logr/blob/master/CHANGELOG.md)
- [Commits](go-logr/logr@v1.4.1...v1.4.2)

Updates `github.com/sigstore/sigstore` from 1.8.3 to 1.8.4
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.3...v1.8.4)

Updates `google.golang.org/api` from 0.181.0 to 0.182.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.181.0...v0.182.0)

Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20240513163218-0867130af1f8 to 0.0.0-20240520151616-dc85e6b867a5
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20240513163218-0867130af1f8 to 0.0.0-20240521202816-d264139d666e
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: github.com/tektoncd/pipeline
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: cloud.google.com/go/iam
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: github.com/docker/docker-credential-helpers
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: github.com/emicklei/go-restful/v3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: github.com/go-logr/logr
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: github.com/sigstore/sigstore
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: google.golang.org/api
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: google.golang.org/genproto/googleapis/api
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the release-note-none Denotes a PR that doesn't merit a release note. label May 29, 2024
@kubevirt-bot kubevirt-bot added the dco-signoff: yes Indicates the PR's author has DCO signed all their commits. label May 29, 2024
@kubevirt-bot kubevirt-bot requested review from akrejcir and jcanocan May 29, 2024 00:27
@openshift-ci openshift-ci bot requested a review from opokornyy May 29, 2024 00:27
@jcanocan
Copy link
Contributor

/retest-required

Copy link
Member

@0xFelix 0xFelix left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 29, 2024
Copy link

openshift-ci bot commented May 29, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: 0xFelix, dependabot[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 29, 2024
@ksimon1 ksimon1 merged commit a9376b0 into main May 29, 2024
7 checks passed
@dependabot dependabot bot deleted the dependabot/go_modules/production-dependencies-885432e357 branch May 29, 2024 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. lgtm Indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesn't merit a release note. size/XXL
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants