Bump the go_modules group across 1 directory with 5 updates

[dependabot]

Bumps the go_modules group with 1 update in the / directory: github.com/cert-manager/cert-manager.

Updates github.com/cert-manager/cert-manager from 1.11.0 to 1.12.14

Release notes

Sourced from github.com/cert-manager/cert-manager's releases.

v1.12.14

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

This patch release of cert-manager 1.12 makes several changes to how PEM input is validated, adding maximum sizes appropriate to the type of PEM data which is being parsed.

This is to prevent an unacceptable slow-down in parsing specially crafted PEM data. The issue was found by Google's OSS-Fuzz project.

The issue is low severity; to exploit the PEM issue would require privileged access which would likely allow Denial-of-Service through other methods.

Note also that since most PEM data parsed by cert-manager comes from ConfigMap or Secret resources which have a max size limit of approximately 1MB, it's difficult to force cert-manager to parse large amounts of PEM data.

Further information is available in GHSA-r4pg-vg54-wxx4

This patch release also fix an issue reported by Trivy, although that issue is low severity and is not expected to be relevant to cert-manager.

Bug Fixes

• Set a maximum size for PEM inputs which cert-manager will accept to remove possibility of taking a long time to process an input (#7403, @​SgtCoDFish)
• Fix CVE-2024-5174 in github.com/golang-jwt/jwt/v4 (#7407, @​SgtCoDFish)

v1.12.13

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

📖 Read the release documentation to learn more more about the features introduced in 1.12.

📜 Changes since v1.12.12

This patch release fixes the following vulnerabilities: CVE-2024-6104, CVE-2024-24791, CVE-2024-25620, CVE-2024-26147, and CVE-2024-41110.

ℹ️ This version contains an unusually large number of Go dependency changes for a patch release. The cert-manager maintainers are confident that it is stable because it has passed the same extensive suite of tests as previous 1.12 releases. But if you are importing cert-manager 1.12 as a Go module you will notice that the minimum Go version is 1.21, and the k8s.io modules are now updated to 0.29.

This reason for the large number of Go dependency changes is that the Helm SDK has been updated to fix security vulnerabilities in cmctl. This required the k8s.io modules to be updated from 0.27 to 0.29 in all components. Those newer minor versions of the Kubernetes modules pulled in new transitive dependencies, and incremented the minimum Go version from 1.20 to 1.21.

Bugfixes

• Bump the go-retryablehttp dependency to fix CVE-2024-6104 (#7128, @​SgtCoDFish)
• Updated Helm dependency to resolve CVE-2024-25620 and CVE-2024-26147 and Docker dependency to resolve CVE-2024-41110 (#7214, @​ThatsMrTalbot)
• Updates Go to 1.21.13 to resolve CVE-2024-24791 (#7216, @​ThatsMrTalbot)

... (truncated)

Commits

• 70a0309 Merge pull request #7403 from SgtCoDFish/release-1.12-pem-inputs
• 9f006c1 Merge pull request #7407 from SgtCoDFish/release-1.12-jwtfix
• ec1d2b4 fix CVE-2024-5174 in jwt dependency
• a197d8f [release-1.12] security: remove calls to pem.Decode in non-test code
• 52cb2e7 security: Add functions to limit max PEM sizes allowable
• 961e195 Merge pull request #7372 from SgtCoDFish/release-1.12-ipv6-dns
• 104b743 [release-1.12] add ipv6 example for DNS arg
• 231a4bd Merge pull request #7224 from wallrj/update-cmd/ctl/v1.12.13
• 32acef6 Update cmd/ctl's go.mod to v1.12.13
• a4704b2 Merge pull request #7223 from cert-manager-bot/cherry-pick-7199-to-release-1.12
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.5.0 to 0.24.0

Commits

• 332fd65 go.mod: update golang.org/x dependencies
• 0b431c7 x509roots/fallback: update bundle
• 349231f ssh: implement CryptoPublicKey on sk keys
• 44c9b0f ssh: allow server auth callbacks to send additional banners
• 67b1361 sha3: reenable s390x assembly
• 477a5b4 sha3: make APIs usable with zero allocations
• 59b5a86 sha3: disable s390x assembly
• 10f366e sha3: simplify XOR functions
• 905d78a go.mod: update golang.org/x dependencies
• ebb717d ssh: validate key type in SSH_MSG_USERAUTH_PK_OK response
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.8.0 to 0.26.0

Commits

• 66e838c go.mod: update golang.org/x dependencies
• 6249541 http2: avoid race in server handler SetReadDeadine/SetWriteDeadline
• 603e3e6 quic: disable X25519Kyber768Draft00 in tests
• 67e8d0c http2: report an error if goroutines outlive serverTester tests
• 5608279 http2: avoid corruption in priority write scheduler
• 0d515a5 http2: factor out frame read/write test functions
• 9f5b79b http2: drop unused retry function
• 03c24c2 http2: use synthetic time in server tests
• 022530c http2: add a more full-featured test net.Conn
• 410d19e http2: avoid racy access to clientStream.requestedGzip
• Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.4.0 to 0.11.0

Commits

• 2e4a4e2 go.mod: update golang.org/x dependencies
• ac6658e all: update go version to 1.18
• ec5679f go.mod: update golang.org/x dependencies
• 989acb1 all: update dependencies to their latest versions
• 2323c81 go.mod: update golang.org/x dependencies
• 839de22 google: don't check for IsNotExist for well-known file
• 0690208 go.mod: update golang.org/x dependencies
• 451d5d6 internal: remove repeated definite articles
• cfe200d oauth2: parse RFC 6749 error response
• 3607514 go.mod: update golang.org/x dependencies
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.28.1 to 1.33.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign inteon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.