Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 12, 2025

Bumps the gomod group with 3 updates in the /git-https-proxy directory: github.com/elazarl/goproxy, github.com/golang-jwt/jwt/v4 and github.com/spf13/viper.

Updates github.com/elazarl/goproxy from 0.0.0-20231117061959-7cc037d33fb5 to 1.7.2

Release notes

Sourced from github.com/elazarl/goproxy's releases.

v1.7.2

What's Changed

  • Avoid breaking changes and port them to the v2 branch instead

Full Changelog: elazarl/goproxy@v1.7.1...v1.7.2

v1.7.1

What's Changed

Full Changelog: elazarl/goproxy@v1.7.0...v1.7.1

v1.7.0: Websocket refactoring

What's Changed

In this pull request, I have dedicated some time to fully refactor the Websocket code to take advantage of the Go standard library. This will also forward the request to a cascade proxy when required.

Full Changelog: elazarl/goproxy@v1.6.1...v1.7.0

v1.6.1

What's Changed

Full Changelog: elazarl/goproxy@v1.6.0...v1.6.1

v1.6.0: Make sure to cancel request context when we're done with it

What's Changed

Full Changelog: elazarl/goproxy@v1.5.0...v1.6.0

Avoid breaking changes in v1

What's Changed

Full Changelog: elazarl/goproxy@v1.4.0...v1.5.0

... (truncated)

Commits

Updates github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1

Release notes

Sourced from github.com/golang-jwt/jwt/v4's releases.

v4.5.1

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

  • Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

Commits

Updates github.com/spf13/viper from 1.18.2 to 1.19.0

Release notes

Sourced from github.com/spf13/viper's releases.

v1.19.0

What's Changed

Bug Fixes 🐛

Dependency Updates ⬆️

... (truncated)

Commits
  • b9733f0 build(deps): bump actions/checkout from 4.1.4 to 4.1.6
  • 6ecc5c8 build(deps): bump cachix/install-nix-action from 26 to 27
  • 248c6fd build(deps): bump github/codeql-action from 3.25.4 to 3.25.7
  • abea773 Update references to bketelsen/crypt
  • f17acb4 build(deps): bump golangci/golangci-lint-action from 4.0.0 to 6.0.1
  • 8e285a5 build(deps): bump github/codeql-action from 3.25.2 to 3.25.4
  • 4017620 build(deps): bump actions/setup-go from 5.0.0 to 5.0.1
  • b67e814 build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.1 to 2.2.2
  • 4a182c7 build(deps): bump actions/dependency-review-action from 4.2.5 to 4.3.2
  • 45a0e12 build(deps): bump mheap/github-action-required-labels
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.9.0 to 1.10.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.10.0

What's Changed

Functional Changes

Fixes

Documantation, Build & CI

New Contributors

... (truncated)

Commits
  • 89cbdd9 Merge pull request #1626 from arjun-1/fix-functional-options-diff-indirect-calls
  • 07bac60 Merge pull request #1667 from sikehish/flaky
  • 716de8d Increase timeouts in Test_Mock_Called_blocks to reduce flakiness in CI
  • 118fb83 NotSame should fail if args are not pointers #1661 (#1664)
  • 7d99b2b attempt 2
  • 05f87c0 more similar
  • ea7129e better fmt
  • a1b9c9e Merge pull request #1663 from ybrustin/master
  • 8302de9 Merge branch 'master' into master
  • 89352f7 Merge pull request #1518 from hendrywiranto/adjust-readme-remove-v2
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 12, 2025
@dependabot dependabot bot requested a review from a team as a code owner March 12, 2025 06:20
@dependabot dependabot bot force-pushed the dependabot/go_modules/git-https-proxy/master/gomod-ded54ae8f3 branch 3 times, most recently from 1085a9f to fa92cb6 Compare March 21, 2025 06:57
@dependabot dependabot bot force-pushed the dependabot/go_modules/git-https-proxy/master/gomod-ded54ae8f3 branch 2 times, most recently from f53d0b4 to 5e35a4c Compare August 8, 2025 06:47
@dependabot dependabot bot force-pushed the dependabot/go_modules/git-https-proxy/master/gomod-ded54ae8f3 branch from 5e35a4c to d9a7553 Compare August 18, 2025 11:02
Bumps the gomod group with 3 updates in the /git-https-proxy directory: [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy), [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) and [github.com/spf13/viper](https://github.com/spf13/viper).


Updates `github.com/elazarl/goproxy` from 0.0.0-20231117061959-7cc037d33fb5 to 1.7.2
- [Release notes](https://github.com/elazarl/goproxy/releases)
- [Commits](https://github.com/elazarl/goproxy/commits/v1.7.2)

Updates `github.com/golang-jwt/jwt/v4` from 4.5.0 to 4.5.1
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](golang-jwt/jwt@v4.5.0...v4.5.1)

Updates `github.com/spf13/viper` from 1.18.2 to 1.19.0
- [Release notes](https://github.com/spf13/viper/releases)
- [Commits](spf13/viper@v1.18.2...v1.19.0)

Updates `github.com/stretchr/testify` from 1.9.0 to 1.10.0
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.9.0...v1.10.0)

---
updated-dependencies:
- dependency-name: github.com/elazarl/goproxy
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gomod
- dependency-name: github.com/golang-jwt/jwt/v4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/spf13/viper
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/stretchr/testify
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/go_modules/git-https-proxy/master/gomod-ded54ae8f3 branch from d9a7553 to a7a6293 Compare August 18, 2025 15:01
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 16, 2025

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot rebase.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants