Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): lock file maintenance #561

Merged
merged 1 commit into from
Oct 4, 2023
Merged

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 4, 2023

Mend Renovate

This PR contains the following updates:

Update Change
lockFileMaintenance All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.


Configuration

📅 Schedule: Branch creation - "before 4am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot requested a review from a team as a code owner October 4, 2023 07:48
@renovate renovate bot added the dependencies label Oct 4, 2023
@viccuad viccuad self-assigned this Oct 4, 2023
@viccuad
Copy link
Member

viccuad commented Oct 4, 2023

There is a security advisory for webpki that this PR solves:
GHSA-8qv2-5vq6-g2g7

Before:

$ cargo tree -i webpki
webpki v0.22.0
├── rustls v0.20.8
│   └── tokio-rustls v0.23.4
│       └── warp v0.3.5
│           └── policy-server v1.7.0-rc1 (/home/vic/suse/kw/policy-server)
├── tokio-rustls v0.23.4 (*)
└── webpki-roots v0.22.6
    └── reqwest v0.11.18
        ├── oauth2 v4.4.1
        │   └── openidconnect v3.3.0
        │       └── sigstore v0.7.2
        │           └── policy-fetcher v0.7.23 (https://github.com/kubewarden/policy-fetcher?tag=v0.7.23#38c78dc6)
        │               └── policy-evaluator v0.11.3 (https://github.com/kubewarden/policy-evaluator?tag=v0.11.3#bf96c0f0)
        │                   └── policy-server v1.7.0-rc1 (/home/vic/suse/kw/policy-server)
        ├── oci-distribution v0.9.4
        │   ├── policy-fetcher v0.7.23 (https://github.com/kubewarden/policy-fetcher?tag=v0.7.23#38c78dc6) (*)
        │   └── sigstore v0.7.2 (*)
        ├── policy-fetcher v0.7.23 (https://github.com/kubewarden/policy-fetcher?tag=v0.7.23#38c78dc6) (*)
        ├── sigstore v0.7.2 (*)
        └── tough v0.13.0
            └── sigstore v0.7.2 (*)

With this PR:

$ cargo tree -i webpki
error: package ID specification `webpki` did not match any packages

        Did you mean `spki`?

Hence, reqwest has dropped webpki and moved to the maintained fork rustls-webpki:

$ cargo tree -i rustls-webpki
rustls-webpki v0.101.6
└── rustls v0.21.7
    ├── hyper-rustls v0.24.1
    │   ├── kube-client v0.86.0
    │   │   └── kube v0.86.0
    │   │       └── policy-evaluator v0.11.5 (https://github.com/kubewarden/policy-evaluator?tag=v0.11.5#d8b7d5e2)
    │   │           └── policy-server v1.7.0 (/home/vic/suse/kw/policy-server)
    │   └── reqwest v0.11.22
    │       ├── oauth2 v4.4.2
    │       │   └── openidconnect v3.3.1
    │       │       └── sigstore v0.7.2
    │       │           └── policy-fetcher v0.8.1 (https://github.com/kubewarden/policy-fetcher?tag=v0.8.1#fb5752de)
    │       │               └── policy-evaluator v0.11.5 (https://github.com/kubewarden/policy-evaluator?tag=v0.11.5#d8b7d5e2) (*)
    │       ├── oci-distribution v0.9.4
    │       │   ├── policy-fetcher v0.8.1 (https://github.com/kubewarden/policy-fetcher?tag=v0.8.1#fb5752de) (*)
    │       │   └── sigstore v0.7.2 (*)
    │       ├── policy-fetcher v0.8.1 (https://github.com/kubewarden/policy-fetcher?tag=v0.8.1#fb5752de) (*)
    │       ├── sigstore v0.7.2 (*)
    │       └── tough v0.13.0
    │           └── sigstore v0.7.2 (*)
    ├── kube-client v0.86.0 (*)
    ├── policy-fetcher v0.8.1 (https://github.com/kubewarden/policy-fetcher?tag=v0.8.1#fb5752de) (*)
    ├── reqwest v0.11.22 (*)
    └── tokio-rustls v0.24.1
        ├── hyper-rustls v0.24.1 (*)
        ├── reqwest v0.11.22 (*)
        └── warp v0.3.6
            └── policy-server v1.7.0 (/home/vic/suse/kw/policy-server)

@viccuad viccuad merged commit dbd4e8d into main Oct 4, 2023
14 checks passed
@viccuad viccuad deleted the renovate/lock-file-maintenance branch October 4, 2023 08:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

1 participant