fix(deps): update module github.com/mattn/go-colorable to v0.1.13 - #260
Merged
renovate[bot] merged 1 commit intoJan 11, 2023
Merged
Conversation
renovate
Bot
requested review from
AlexsJones,
james-milligan and
toddbaert
as code owners
January 10, 2023 20:39
renovate
Bot
force-pushed
the
renovate/hub.lumenfield.work-mattn-go-colorable-0.x
branch
from
January 11, 2023 00:42
d11d2c1 to
ee233ce
Compare
renovate
Bot
force-pushed
the
renovate/hub.lumenfield.work-mattn-go-colorable-0.x
branch
from
January 11, 2023 04:36
ee233ce to
e71d219
Compare
renovate
Bot
deleted the
renovate/hub.lumenfield.work-mattn-go-colorable-0.x
branch
January 11, 2023 08:10
james-milligan
pushed a commit
that referenced
this pull request
Jan 12, 2023
🤖 I have created a release *beep* *boop* --- ## [0.3.1](v0.3.0...v0.3.1) (2023-01-12) ### Features * file extension detection ([#257](#257)) ([ca22541](ca22541)) * ResolveAll endpoint for bulk evaluation ([#239](#239)) ([6437c43](6437c43)) ### Bug Fixes * **deps:** update module github.com/bufbuild/connect-go to v1.4.1 ([#268](#268)) ([712d7dd](712d7dd)) * **deps:** update module github.com/mattn/go-colorable to v0.1.13 ([#260](#260)) ([5b11504](5b11504)) * **deps:** update module github.com/open-feature/open-feature-operator to v0.2.23 ([#261](#261)) ([a1dd3b9](a1dd3b9)) * **deps:** update module github.com/rs/cors to v1.8.3 ([#264](#264)) ([0e6f2f3](0e6f2f3)) * **deps:** update module github.com/stretchr/testify to v1.8.1 ([#265](#265)) ([2ec61c6](2ec61c6)) * improve invalid sync URI errror msg ([#252](#252)) ([5939870](5939870)) * replace character slice with regex replace ([#250](#250)) ([c92d101](c92d101)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
raphael-wigoutschnigg-dt
pushed a commit
to open-feature-forking/flagd
that referenced
this pull request
Mar 11, 2025
…/connect-go to v1.5.2-20230710190440-2333a9579c1a.1 (open-feature#260) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
jonathannorris
added a commit
that referenced
this pull request
Jul 20, 2026
…edback - github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2 in test/integration (medium, alert #260) - js-yaml ^4.1.1 -> ^4.2.0 and vite ^6.4.2 -> ^6.4.3 in playground-app (medium/high, alerts #207, #199, #200); lockfile already resolved these transitively, this pins the direct specifiers to match - Root-cause fix for a regression introduced by the prior testcontainers-go v0.41.0 -> v0.43.0 bump: v0.43.0's modules/compose changed DockerContainer.MappedPort's signature (nat.Port -> string), which is incompatible with go-sdk-contrib/tests/flagd/v2@v2.0.2's testframework (pinned, no newer version exists) and broke `go vet`/`go test` compilation in test/integration (go build alone didn't catch it since _test.go files aren't compiled by `go build`). Reverted testcontainers-go and testcontainers-go/modules/compose to v0.41.0 (API-compatible) while keeping the already-patched transitive containerd/containerd/v2 v2.2.5 and other bumps pinned via explicit go.mod requires, so alerts #189, #192-#196 remain resolved without reintroducing the vulnerable containerd version. - Add ReadTimeout to the flagd-proxy metrics server's http.Server per CodeRabbit review feedback on this PR: ReadHeaderTimeout alone only bounds header parsing, leaving the plain HTTP/h2c port open to slow-client (Slowloris-style) resource exhaustion. Still unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, #186) remains at v28.5.2+incompatible in test/integration. No version >= 28.5.2 (including the advisory's referenced 29.3.1 for alert #152) is published under the legacy github.com/docker/docker import path in the Go module proxy; moby now ships new majors under github.com/moby/moby/v2, which this module graph cannot switch to without deeper dependency surgery. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert
pushed a commit
that referenced
this pull request
Jul 20, 2026
…edback - github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2 in test/integration (medium, alert #260) - js-yaml ^4.1.1 -> ^4.2.0 and vite ^6.4.2 -> ^6.4.3 in playground-app (medium/high, alerts #207, #199, #200); lockfile already resolved these transitively, this pins the direct specifiers to match - Root-cause fix for a regression introduced by the prior testcontainers-go v0.41.0 -> v0.43.0 bump: v0.43.0's modules/compose changed DockerContainer.MappedPort's signature (nat.Port -> string), which is incompatible with go-sdk-contrib/tests/flagd/v2@v2.0.2's testframework (pinned, no newer version exists) and broke `go vet`/`go test` compilation in test/integration (go build alone didn't catch it since _test.go files aren't compiled by `go build`). Reverted testcontainers-go and testcontainers-go/modules/compose to v0.41.0 (API-compatible) while keeping the already-patched transitive containerd/containerd/v2 v2.2.5 and other bumps pinned via explicit go.mod requires, so alerts #189, #192-#196 remain resolved without reintroducing the vulnerable containerd version. - Add ReadTimeout to the flagd-proxy metrics server's http.Server per CodeRabbit review feedback on this PR: ReadHeaderTimeout alone only bounds header parsing, leaving the plain HTTP/h2c port open to slow-client (Slowloris-style) resource exhaustion. Still unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, #186) remains at v28.5.2+incompatible in test/integration. No version >= 28.5.2 (including the advisory's referenced 29.3.1 for alert #152) is published under the legacy github.com/docker/docker import path in the Go module proxy; moby now ships new majors under github.com/moby/moby/v2, which this module graph cannot switch to without deeper dependency surgery. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert
pushed a commit
that referenced
this pull request
Jul 20, 2026
…edback - github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2 in test/integration (medium, alert #260) - js-yaml ^4.1.1 -> ^4.2.0 and vite ^6.4.2 -> ^6.4.3 in playground-app (medium/high, alerts #207, #199, #200); lockfile already resolved these transitively, this pins the direct specifiers to match - Root-cause fix for a regression introduced by the prior testcontainers-go v0.41.0 -> v0.43.0 bump: v0.43.0's modules/compose changed DockerContainer.MappedPort's signature (nat.Port -> string), which is incompatible with go-sdk-contrib/tests/flagd/v2@v2.0.2's testframework (pinned, no newer version exists) and broke `go vet`/`go test` compilation in test/integration (go build alone didn't catch it since _test.go files aren't compiled by `go build`). Reverted testcontainers-go and testcontainers-go/modules/compose to v0.41.0 (API-compatible) while keeping the already-patched transitive containerd/containerd/v2 v2.2.5 and other bumps pinned via explicit go.mod requires, so alerts #189, #192-#196 remain resolved without reintroducing the vulnerable containerd version. - Add ReadTimeout to the flagd-proxy metrics server's http.Server per CodeRabbit review feedback on this PR: ReadHeaderTimeout alone only bounds header parsing, leaving the plain HTTP/h2c port open to slow-client (Slowloris-style) resource exhaustion. Still unresolvable: github.com/docker/docker (alerts #151, #152, #184, #185, #186) remains at v28.5.2+incompatible in test/integration. No version >= 28.5.2 (including the advisory's referenced 29.3.1 for alert #152) is published under the legacy github.com/docker/docker import path in the Go module proxy; moby now ships new majors under github.com/moby/moby/v2, which this module graph cannot switch to without deeper dependency surgery. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
toddbaert
added a commit
that referenced
this pull request
Jul 20, 2026
## Summary Resolves all cleanly patchable open Dependabot security alerts (28 of 33). The remaining 5 have no available patched version for their legacy import path — see below. ## Dependabot Alerts Resolved | Alert | Package | Severity | Fix | |-------|---------|----------|-----| | #260 | `github.com/sigstore/sigstore-go` | **medium** | Bumped to v1.2.2 in `test/integration` | | #247-#259 (13 alerts) | `golang.org/x/crypto` | **critical/high/medium** | Already resolved on `main` (v0.52.0+); carried through the rebase | | #207 | `js-yaml` | **medium** | Bumped to `^4.2.0` in `playground-app` | | #206, #202, #201 | `golang.org/x/net` | **medium** | Bumped to v0.55.0/v0.56.0 across `flagd`, `core`, `flagd-proxy`, `test/integration`, and related test modules | | #200, #199 | `vite` | **medium/high** | Bumped to `^6.4.3` in `playground-app` | | #197 | `@babel/core` | **low** | Forced `>=7.29.6` via npm override in `playground-app` | | #189, #192-#196 | `github.com/containerd/containerd/v2` | **high/medium** | Bumped to v2.2.5 in `test/integration` (kept on `testcontainers-go` v0.41.0 — see note below) | | #190 | `js-cookie` | **high** | Forced `>=3.0.7` via npm override in `playground-app` | **Note on containerd fix:** an earlier revision of this branch bumped `testcontainers-go` to v0.43.0 to reach patched `containerd/v2`, but that also changed `DockerContainer.MappedPort`'s signature in a way that's incompatible with `go-sdk-contrib/tests/flagd/v2@v2.0.2` (pinned; no newer version exists) — breaking `go vet`/`go test` compilation in `test/integration` (not caught by `go build` alone, since it doesn't compile `_test.go` files). Reverted `testcontainers-go` to v0.41.0 (API-compatible) while keeping `containerd/containerd/v2` pinned at v2.2.5 via an explicit `go.mod` require — standard Go MVS, no `replace` directive needed. ## Unresolvable Alerts **`github.com/docker/docker`** (#151, #152, #184, #185, #186) in `test/integration`: pinned at `v28.5.2+incompatible`. No version ≥ that (including the advisory's referenced `v29.3.1` for #152) exists under the legacy `github.com/docker/docker` import path in the Go module proxy — moby now ships new majors under `github.com/moby/moby/v2`. Transitive dependency of testcontainers/buildx/compose; unresolvable until those upstreams migrate. | Alert | Package | Severity | Reason | |-------|---------|----------|--------| | #186 | `github.com/docker/docker` | **high** | No patched version in Go module proxy | | #185 | `github.com/docker/docker` | **medium** | No patched version in Go module proxy | | #184 | `github.com/docker/docker` | **high** | No patched version in Go module proxy | | #152 | `github.com/docker/docker` | **high** | Advisory's patched version (29.3.1) not published for this import path | | #151 | `github.com/docker/docker` | **medium** | No patched version in Go module proxy | ## Other changes - Added `ReadTimeout` to the flagd-proxy metrics server's `http.Server` (`flagd-proxy/pkg/service/server.go`) per CodeRabbit review feedback, hardening the plain HTTP/h2c port against slow-client resource exhaustion. ## Verification - `make test`, `make build`, and `go vet` pass across all Go modules (`core`, `flagd`, `flagd-proxy`, `flagd-proxy/tests/loadtest`, `test/zero-downtime-flagd-proxy`). - `test/integration`: `go build ./...`, `go vet ./...`, and `go test` (compile-only; actual container run needs a Docker daemon) all pass. - `playground-app`: `npm run build` succeeds; `npm install --package-lock-only --dry-run` reports up to date. --------- Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com> Signed-off-by: Todd Baert <todd.baert@dynatrace.com> Co-authored-by: Todd Baert <todd.baert@dynatrace.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.1.12->v0.1.13⚠ Dependency Lookup Warnings ⚠
Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.
Release Notes
mattn/go-colorable
v0.1.13Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.