Bump the go-deps group across 1 directory with 5 updates

[dependabot]

Bumps the go-deps group with 3 updates in the / directory: github.com/cyphar/filepath-securejoin, github.com/fluxcd/cli-utils and github.com/getsops/sops/v3.

Updates github.com/cyphar/filepath-securejoin from 0.3.2 to 0.3.4

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.3.4

This release primarily includes a fix that blocked using filepath-securejoin in Kubernetes.

• Previously, some testing mocks we had resulted in us doing import "testing" in non-_test.go code, which made some downstreams like Kubernetes unhappy. This has been fixed. (#32)

Thanks to all of the contributors who made this release possible:

• Aleksa Sarai [email protected]
• Stephen Kitt [email protected]

Signed-off-by: Aleksa Sarai [email protected]

v0.3.3

This release primarily includes fixes for spurious errors we hit when checking that directories created by MkdirAll "look right". Upon further consideration, these checks were fundamentally buggy and didn't offer any practical protection anyway.

• The mode and owner verification logic in MkdirAll has been removed. This was originally intended to protect against some theoretical attacks but upon further consideration these protections don't actually buy us anything and they were causing spurious errors with more complicated filesystem setups.
• The "is the created directory empty" logic in MkdirAll has also been removed. This was not causing us issues yet, but some pseudofilesystems (such as cgroup) create non-empty directories and so this logic would've been wrong for such cases.

Thanks to all of the contributors who made this release possible:

• Aleksa Sarai [email protected]
• Kir Kolyshkin [email protected]

Signed-off-by: Aleksa Sarai [email protected]

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.3.4] - 2024-10-09

Fixed

• Previously, some testing mocks we had resulted in us doing import "testing" in non-_test.go code, which made some downstreams like Kubernetes unhappy. This has been fixed. (#32)

[0.3.3] - 2024-09-30

Fixed

• The mode and owner verification logic in MkdirAll has been removed. This was originally intended to protect against some theoretical attacks but upon further consideration these protections don't actually buy us anything and they were causing spurious errors with more complicated filesystem setups.
• The "is the created directory empty" logic in MkdirAll has also been removed. This was not causing us issues yet, but some pseudofilesystems (such as cgroup) create non-empty directories and so this logic would've been wrong for such cases.

Commits

• fd16ade VERSION: release v0.3.4
• 00e0710 godoc: update package documentation
• 0cd6be1 README: fix reference to open_tree kernel requirements
• 205046f README: add pkg.go.dev badge
• ecb1b8e tests: procfs: clean up mock test hook
• 3ec6eed CHANGELOG: mention #32 fix
• 86e6182 merge #32 into cyphar/filepath-securejoin:main
• 6864912 Isolate the testing import in test code
• 4348fee openat: remove unused function
• d0c7d67 merge #31 into cyphar/filepath-securejoin:main
• Additional commits viewable in compare view

Updates github.com/fluxcd/cli-utils from 0.36.0-flux.9 to 0.36.0-flux.10

Commits

• edea475 Merge pull request #11 from fluxcd/kustomize-v5.5
• 8e327e5 Update kustomize to v5.5.0
• See full diff in compare view

Updates github.com/getsops/sops/v3 from 3.9.0 to 3.9.2

Release notes

Sourced from github.com/getsops/sops/v3's releases.

v3.9.2

Installation

To install sops, download one of the pre-built binaries provided for your platform from the artifacts attached to this release.

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/getsops/sops/releases/download/v3.9.2/sops-v3.9.2.linux.amd64
Move the binary in to your PATH
mv sops-v3.9.2.linux.amd64 /usr/local/bin/sops
Make the binary executable
chmod +x /usr/local/bin/sops

Verify checksums file signature

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/getsops/sops/releases/download/v3.9.2/sops-v3.9.2.checksums.txt
curl -LO https://github.com/getsops/sops/releases/download/v3.9.2/sops-v3.9.2.checksums.pem
curl -LO https://github.com/getsops/sops/releases/download/v3.9.2/sops-v3.9.2.checksums.sig
Verify the checksums file
cosign verify-blob sops-v3.9.2.checksums.txt 
--certificate sops-v3.9.2.checksums.pem 
--signature sops-v3.9.2.checksums.sig 
--certificate-identity-regexp=https://github.com/getsops 
--certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature:

# Verify the binary using the checksums file
sha256sum -c sops-v3.9.2.checksums.txt --ignore-missing

Verify artifact provenance

The SLSA provenance of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an in-toto link metadata file named sops-v3.9.2.intoto.jsonl. To verify the provenance of an artifact, you can utilize the slsa-verifier tool:

</tr></table> 

... (truncated)

Changelog

Sourced from github.com/getsops/sops/v3's changelog.

3.9.2

Improvements:

• Dependency updates (#1645, #1649, #1653, #1662, #1686, #1693).
• Update compiled Protobuf definitions (#1688).
• Remove unused variables and simplify conditional (##1687).

Bugfixes:

• Handle whitespace in Azure Key Vault URLs (#1652).
• Correctly handle comments during JSON serialization (#1647).

Project changes:

• CI dependency updates (#1644, #1648, #1654, #1664, #1673, #1677, #1685).
• Rust dependency updates (#1655, #1663, #1670, #1676, #1689).
• Update and improve Protobuf code generation (#1688).

3.9.1

Improvements:

• Dependency updates (#1550, #1554, #1558, #1562, #1565, #1568, #1575, #1581, #1589, #1593, #1602, #1603, #1618, #1629, #1635, #1639, #1640).
• Clarify naming of the configuration file in the documentation (#1569).
• Build with Go 1.22 (#1589).
• Specify filename of missing file in error messages (#1625).
• updatekeys subcommand: show changes in shamir_threshold (#1609).

Bugfixes:

• Fix the URL used for determining the latest SOPS version (#1553).
• updatekeys subcommand: actually use option --shamir-secret-sharing-threshold (#1608).
• Fix --config being ignored in subcommands by loadConfig (#1613).
• Allow edit subcommand to create files (#1596).
• Do not encrypt if a key group is empty, or there are no key groups (#1600).
• Do not ignore config errors when trying to parse a config file (#1614).

Project changes:

• CI dependency updates (#1551, #1555, #1559, #1564, #1566, #1574, #1584, #1586, #1590, #1592, #1619, #1628, #1634).
• Improve CI workflows (#1548, #1630).
• Ignore user-set environment variable SOPS_AGE_KEY_FILE in tests (#1595).
• Add example of using Age recipients in .sops.yaml (#1607).
• Add linting check for Rust code formatting (#1604).
• Set Rust version globally via rust-toolchain.toml for functional tests (#1612).
• Improve test coverage (#1617).

... (truncated)

Commits

• bb710f3 Merge pull request #1691 from felixfontein/release-3.9.2
• 9c983ef Add changelog for 3.9.2.
• 2e4777f Bump version to 3.9.2.
• af4cbbd Merge pull request #1693 from getsops/dependabot/go_modules/go-d71f92e84c
• 36cba34 build(deps): Bump the go group with 8 updates
• 2afd373 Merge pull request #1688 from felixfontein/protobuf
• 062a60c Update go.mod.
• eda6ec1 Adjust protoc command line for latest versions of plugins; fix protoc Go plug...
• 47a6c97 keyservice: update protobuf to an recent release
• 27dc305 Merge pull request #1687 from nicklasfrahm/feature/config-problems
• Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.34.2 to 1.36.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.36.0

1.36.0

Features

• new: make collection-related matchers Go 1.23 iterator aware [4c964c6]

Maintenance

• Replace min/max helpers with built-in min/max [ece6872]
• Fix some typos in docs [8e924d7]

v1.35.1

1.35.1

Fixes

• Export EnforceDefaultTimeoutsWhenUsingContexts and DisableDefaultTimeoutsWhenUsingContext [ca36da1]

v1.35.0

1.35.0

Features

• You can now call EnforceDefaultTimeoutsWhenUsingContexts() to have Eventually honor the default timeout when passed a context. (prior to this you had to expclility add a timeout) [e4c4265]
• You can call StopTrying(message).Successfully() to abort a Consistently early without failure [eeca931]

Fixes

• Stop memoizing the result of HaveField to avoid unexpected errors when used with async assertions. [3bdbc4e]

Maintenance

• Bump all dependencies [a05a416]

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.36.0

Features

• new: make collection-related matchers Go 1.23 iterator aware [4c964c6]

Maintenance

• Replace min/max helpers with built-in min/max [ece6872]
• Fix some typos in docs [8e924d7]

1.35.1

Fixes

• Export EnforceDefaultTimeoutsWhenUsingContexts and DisableDefaultTimeoutsWhenUsingContext [ca36da1]

1.35.0

Features

• You can now call EnforceDefaultTimeoutsWhenUsingContexts() to have Eventually honor the default timeout when passed a context. (prior to this you had to expclility add a timeout) [e4c4265]
• You can call StopTrying(message).Successfully() to abort a Consistently early without failure [eeca931]

Fixes

• Stop memoizing the result of HaveField to avoid unexpected errors when used with async assertions. [3bdbc4e]

Maintenance

• Bump all dependencies [a05a416]

Commits

• f1ff459 v1.36.0
• 4c964c6 new: make collection-related matchers Go 1.23 iterator aware
• ece6872 Replace min/max helpers with built-in min/max
• 8e924d7 Fix some typos in docs
• 9f5a208 v1.35.1
• ca36da1 Export EnforceDefaultTimeoutsWhenUsingContexts and DisableDefaultTimeoutsWhen...
• d6331f9 v1.35.0
• 5deaf23 fix tests, but like actually this time
• eeca931 Add Successfully() to StopTrying() to signal that Consistently can end early ...
• 3bdbc4e stop memoizing result of HaveField
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.29.0 to 0.31.0

Commits

• 334afa0 go.mod: update golang.org/x dependencies
• d7f220d quic: add LocalAddr and RemoteAddr to quic.Conn
• 858db1a http2: surface errors occurring very early in a client conn's lifetime
• 0aa844c http2: support unencrypted HTTP/2 handoff from net/http
• f35fec9 http2: detect hung client connections by confirming stream resets
• e883dae README: don't recommend go get
• 511cc3a html: add Node.{Ancestors,ChildNodes,Descendants}()
• 4783315 http2: limit 1xx based on size, do not limit when delivered
• 5716b98 internal/socket: execute gofmt
• 42b1186 http2: support ResponseController.EnableFullDuplex
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.