Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-19 23:18:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 96
fleet/go.mod

356 lines
17 KiB
Modula-2
Raw Normal View History

Add v4 suffix in go.mod (#1224)
2021-06-26 04:46:51 +00:00
module github.com/fleetdm/fleet/v4
Migrate dependencies to go modules (#2094) These changes should be transparent to users and developers. Thanks to @davepgreene who made the first stab at this.
2019-08-13 17:32:23 +00:00
Updated go to 1.25.1 (#32833)
2025-09-11 23:31:39 +00:00
go 1.25.1
Migrate dependencies to go modules (#2094) These changes should be transparent to users and developers. Thanks to @davepgreene who made the first stab at this.
2019-08-13 17:32:23 +00:00
require (
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
cloud.google.com/go/pubsub v1.45.1
Fix Fleet Desktop bugs on Windows (#16402) #15821 This PR is adding two improvements and fixing two Windows bugs in Fleet Desktop: ## Improvement - We are now capturing the stderr of Fleet Desktop. This helped me find bug (1) below (otherwise the panic output below was hidden from us). - To reduce complexity I'm removing the "Theme detection" routine because we made the decision to use the colored icon for both themes..., see here: https://github.com/fleetdm/fleet/blob/415d1f493b91d9f40d87b968ce95cfc01e810e56/orbit/cmd/desktop/desktop_windows.go#L21-L27 ## Bug fixes 1. Fleet Desktop icon not showing in the task bar. This was fixed by updating to use the latest version of `fyne.io/systray`. (See https://github.com/fyne-io/systray/issues/22#issuecomment-1173157898.) 2. Orbit now properly detects if Fleet Desktop isn't running on Windows. Bug (1)'s panic output ``` panic: runtime error: invalid memory address or nil pointer dereference [signal 0xc0000005 code=0x0 addr=0x0 pc=0x72b14b] goroutine 23 [running]: fyne.io/systray.(*winTray).setTooltip(0x1eb5d40, {0x126923f?, 0x0?}) /Users/luk/gopath/pkg/mod/fyne.io/systray@v1.10.0/systray_windows.go:260 +0xcb fyne.io/systray.SetTooltip({0x126923f?, 0x125fc16?}) /Users/luk/gopath/pkg/mod/fyne.io/systray@v1.10.0/systray_windows.go:961 +0x29 main.main.func1() /Users/luk/fleetdm/git/fleet/orbit/cmd/desktop/desktop.go:103 +0xba fyne.io/systray.Register.func2() /Users/luk/gopath/pkg/mod/fyne.io/systray@v1.10.0/systray.go:98 +0x2f created by fyne.io/systray.Register in goroutine 1 /Users/luk/gopath/pkg/mod/fyne.io/systray@v1.10.0/systray.go:96 +0xb1 ``` - [X] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [X] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [X] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [x] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2024-01-29 21:52:55 +00:00
fyne.io/systray v1.10.1-0.20240111184411-11c585fff98d
Implement fleetctl goquery (#2186) - Update fleet APIs to support necessary operations in goquery - Implement support for goquery in fleetctl
2020-01-24 05:27:20 +00:00
github.com/AbGuthrie/goquery/v2 v2.0.1
Updated OpenTelemetry dependencies to latest. (#23186) #23183 Updated OpenTelemetry libraries as part of research into error logging for orbit. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Manual QA for all new/changed functionality
2024-10-25 14:43:32 +00:00
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358
Test and correct semantics for MySQL withRetryTxx (#488) - Differentiate retryable vs. non-retryable errors. - Test functionality against mocked DB.
2021-03-17 18:23:52 +00:00
github.com/DATA-DOG/go-sqlmock v1.5.0
implement a thin wrapper around stdlib errors (#5733) This solves #5679 , and also implements #5515, #5509 and lays the ground for #5516 With the introduction of Wrap, Is and As in the standard library, we've now got built-in support for wrapping. On top of that, a common pattern in the community is to define errors tailored to the context of each project while still conforming to the error and Unwrap interfaces (see Upspin, Chromium) The output now includes stack traces and additional info
2022-05-18 14:47:55 +00:00
github.com/Masterminds/semver v1.5.0
Bump github.com/golang/glog from 1.2.2 to 1.2.4 (#25818)
2025-01-28 20:58:42 +00:00
github.com/Masterminds/semver/v3 v3.3.1
Move nanomdm dependency in monorepo (#16015) #15557 Following the precedent that Lucas used for other similar PRs, the best way to review is probably by commits. * The first one simply copies over the files from the fork to the monorepo * Second one adjusts all import paths * Third one tidies up the `go.mod` files * Last one fixes the linter issues in the nanomdm package # Checklist for submitter - ~~Changes file added for user-visible changes in `changes/` or `orbit/changes/`.~~ (not a user-visible change) - [x] Manual QA for all new/changed functionality (ran test suite, re-generated mocks) I also verified that our Go test suite did run the newly moved `nanomdm` package steps: ``` ok github.com/fleetdm/fleet/v4/server/mdm/nanomdm/cryptoutil 0.003s coverage: 0.0% of statements in github.com/fleetdm/fleet/v4/... ok github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm 0.005s coverage: 46.2% of statements in github.com/fleetdm/fleet/v4/... ok github.com/fleetdm/fleet/v4/server/mdm/nanomdm/service/certauth 1.320s coverage: 20.7% of statements in github.com/fleetdm/fleet/v4/... ok github.com/fleetdm/fleet/v4/server/mdm/nanomdm/storage/file 0.007s coverage: 24.1% of statements in github.com/fleetdm/fleet/v4/... ```
2024-01-12 02:28:48 +00:00
github.com/RobotsAndPencils/buford v0.14.0
Migrate dependencies to go modules (#2094) These changes should be transparent to users and developers. Thanks to @davepgreene who made the first stab at this.
2019-08-13 17:32:23 +00:00
github.com/VividCortex/mysqlerr v0.0.0-20170204212430-6c6b55f8796f
github.com/WatchBeam/clock v0.0.0-20170901150240-b08e6b4da7ea
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
github.com/XSAM/otelsql v0.39.0
Bump github.com/andygrunwald/go-jira from 1.15.1 to 1.16.0 (#7736) Bumps [github.com/andygrunwald/go-jira](https://github.com/andygrunwald/go-jira) from 1.15.1 to 1.16.0. - [Release notes](https://github.com/andygrunwald/go-jira/releases) - [Changelog](https://github.com/andygrunwald/go-jira/blob/main/CHANGELOG.md) - [Commits](https://github.com/andygrunwald/go-jira/compare/v1.15.1...v1.16.0) --- updated-dependencies: - dependency-name: github.com/andygrunwald/go-jira dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-13 21:22:20 +00:00
github.com/andygrunwald/go-jira v1.16.0
run go mod tidy and fix incorrectly imported dependency (#9529) Two minor things are happening here: 1. A new direct dependency was added in #9489, this runs `go mod tidy` to update `go.mod` and `go.sum` 2. `"go.uber.org/atomic"` was automatically imported instead of `"sys/atomic"` in #9494
2023-01-27 17:51:27 +00:00
github.com/antchfx/xmlquery v1.3.14
Bump github.com/docker/docker from 26.1.4+incompatible to 26.1.5+incompatible (#21230)
2024-08-09 19:25:35 +00:00
github.com/apex/log v1.9.0
Add support for reading private_key from AWS Secrets Manager (#31134) Adds support for reading server `private_key` from AWS Secrets Manager. Combined with #31075, this should allow removing all common sensitive secrets from the environment/config (if I missed any let me know). This works with localstack for local development (set `AWS_ENDPOINT_URL=$LOCALSTACK_URL`, `AWS_ACCESS_KEY_ID=test`, and `AWS_SECRET_ACCESS_KEY=test`). I did not include config options for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` because they are a bad practice vs role credentials and defeat the purpose of this feature which is to remove secrets from the environment/config. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality --------- Co-authored-by: Scott Gress <scott@fleetdm.com>
2025-09-09 21:56:35 +00:00
github.com/aws/aws-sdk-go-v2 v1.36.6
Migrate from `aws-sdk-go` v1 to v2 (#30308) #29482 [Migrate to the AWS SDK for Go v2](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/migrate-gosdk.html) documents how to migrate codebases. QA on features that use AWS SDK Go: - Bootstrap package: - upload: ✅ - download: ✅ - cleanup: ✅ - Software (upload, download, installation, etc.) ✅ - Cloudfront: Luckly, this feature was already using aws-sdk-go-v2. - Carves ✅ - Logging: - Firehose ✅ - Kinesis ✅ - Lambda ✅ (tested result logs to a lambda function on our AWS Dogfood account) - Email: - Amazon SES TODO ⚠️ (this is what Dogfood uses and a few customers) - We cannot easily test locally, we can use dogfood or load testing (AWS) environments. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality
2025-06-30 20:45:39 +00:00
github.com/aws/aws-sdk-go-v2/config v1.29.17
github.com/aws/aws-sdk-go-v2/credentials v1.17.70
Bump github.com/golang/glog from 1.2.2 to 1.2.4 (#25818)
2025-01-28 20:58:42 +00:00
github.com/aws/aws-sdk-go-v2/feature/cloudfront/sign v1.8.3
Feat 1817 add iam auth to mysql and redis (#32488) for #1817 # Details This PR gives Fleet servers the ability to connect to RDS MySQL and Elasticache Redis via AWS [Identity and Access Management (IAM)](https://aws.amazon.com/iam/). It is based almost entirely on the work of @titanous, branched from his [original pull request](https://github.com/fleetdm/fleet/pull/31075). The main differences between his branch and this are: 1. Removal of auto-detection of AWS region (and cache name for Elasticache) in favor of specifying these values in configuration. The auto-detection is admittedly handy but parsing AWS host URLs is not considered a best practice. 2. Relying on the existence of these new configs to determine whether or not to connect via IAM. This sidesteps a thorny issue of whether to try an IAM-based Elasticache connection when a password is not supplied, since this is technically a valid setup. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually - besides using @titanous's excellent test tool, I verified the following end-to-end: - [X] regular (non RDS) MySQL connection - [X] RDS MySQL connection using username/password - [X] RDS MySQL connection using IAM (no role) - [X] RDS MySQL connection using IAM (assuming role) - [X] regular (non Elasticache) Redis connection - [X] Elasticache Redis connection using username/password - [X] Elasticache Redis connection using NO password (without IAM) - [X] Elasticache Redis connection using IAM (no role) - [X] Elasticache Redis connection using IAM (assuming role) --------- Co-authored-by: Jonathan Rudenberg <jonathan@titanous.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2025-09-04 15:08:47 +00:00
github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.13
Migrate from `aws-sdk-go` v1 to v2 (#30308) #29482 [Migrate to the AWS SDK for Go v2](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/migrate-gosdk.html) documents how to migrate codebases. QA on features that use AWS SDK Go: - Bootstrap package: - upload: ✅ - download: ✅ - cleanup: ✅ - Software (upload, download, installation, etc.) ✅ - Cloudfront: Luckly, this feature was already using aws-sdk-go-v2. - Carves ✅ - Logging: - Firehose ✅ - Kinesis ✅ - Lambda ✅ (tested result logs to a lambda function on our AWS Dogfood account) - Email: - Amazon SES TODO ⚠️ (this is what Dogfood uses and a few customers) - We cannot easily test locally, we can use dogfood or load testing (AWS) environments. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality
2025-06-30 20:45:39 +00:00
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.81
github.com/aws/aws-sdk-go-v2/service/firehose v1.37.7
github.com/aws/aws-sdk-go-v2/service/kinesis v1.35.3
github.com/aws/aws-sdk-go-v2/service/lambda v1.72.0
github.com/aws/aws-sdk-go-v2/service/s3 v1.81.0
Add support for reading private_key from AWS Secrets Manager (#31134) Adds support for reading server `private_key` from AWS Secrets Manager. Combined with #31075, this should allow removing all common sensitive secrets from the environment/config (if I missed any let me know). This works with localstack for local development (set `AWS_ENDPOINT_URL=$LOCALSTACK_URL`, `AWS_ACCESS_KEY_ID=test`, and `AWS_SECRET_ACCESS_KEY=test`). I did not include config options for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` because they are a bad practice vs role credentials and defeat the purpose of this feature which is to remove secrets from the environment/config. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality --------- Co-authored-by: Scott Gress <scott@fleetdm.com>
2025-09-09 21:56:35 +00:00
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.8
Migrate from `aws-sdk-go` v1 to v2 (#30308) #29482 [Migrate to the AWS SDK for Go v2](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/migrate-gosdk.html) documents how to migrate codebases. QA on features that use AWS SDK Go: - Bootstrap package: - upload: ✅ - download: ✅ - cleanup: ✅ - Software (upload, download, installation, etc.) ✅ - Cloudfront: Luckly, this feature was already using aws-sdk-go-v2. - Carves ✅ - Logging: - Firehose ✅ - Kinesis ✅ - Lambda ✅ (tested result logs to a lambda function on our AWS Dogfood account) - Email: - Amazon SES TODO ⚠️ (this is what Dogfood uses and a few customers) - We cannot easily test locally, we can use dogfood or load testing (AWS) environments. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality
2025-06-30 20:45:39 +00:00
github.com/aws/aws-sdk-go-v2/service/ses v1.30.4
Fleet server verifies HTTP signature (#30825) Fixes #30473 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Added/updated automated tests - [ ] Manual QA for all new/changed functionality <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for TPM-backed host identity certificates enabling hardware-backed HTTP signature authentication for hosts. * Introduced HTTP signature verification middleware for API requests, applied conditionally for premium licenses. * Hosts presenting identity certificates must authenticate with matching HTTP message signatures during enrollment and authentication. * Added SCEP-based certificate issuance for secure host identity management. * Updated enrollment endpoints to use standardized request/response contract types. * **Bug Fixes** * Enhanced authentication logic to verify consistency between host identity certificates and host records, preventing duplicate or mismatched identities. * **Chores** * Updated dependencies and test infrastructure to support HTTP signature verification and host identity certificate workflows. * Added comprehensive integration and datastore tests for host identity certificate issuance, storage, and authentication. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-16 18:08:27 +00:00
github.com/aws/aws-sdk-go-v2/service/sts v1.34.0
Migrate from `aws-sdk-go` v1 to v2 (#30308) #29482 [Migrate to the AWS SDK for Go v2](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/migrate-gosdk.html) documents how to migrate codebases. QA on features that use AWS SDK Go: - Bootstrap package: - upload: ✅ - download: ✅ - cleanup: ✅ - Software (upload, download, installation, etc.) ✅ - Cloudfront: Luckly, this feature was already using aws-sdk-go-v2. - Carves ✅ - Logging: - Firehose ✅ - Kinesis ✅ - Lambda ✅ (tested result logs to a lambda function on our AWS Dogfood account) - Email: - Amazon SES TODO ⚠️ (this is what Dogfood uses and a few customers) - We cannot easily test locally, we can use dogfood or load testing (AWS) environments. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality
2025-06-30 20:45:39 +00:00
github.com/aws/smithy-go v1.22.4
Replace home-made SAML implementation with https://github.com/crewjam/saml (#28486) For https://github.com/fleetdm/confidential/issues/9931. [Here](https://github.com/fleetdm/fleet/blob/ec3e8edbdc3f1b4220ada22c8290dbf0237ce1ba/docs/Contributing/Testing-and-local-development.md?plain=1#L339)'s how to test SAML locally with SimpleSAML. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved SSO and SAML integration with enhanced session management using secure cookies. * Added support for IdP-initiated login flows. * Introduced new tests covering SSO login flows, metadata handling, and error scenarios. * **Bug Fixes** * Enhanced validation and error handling for invalid or tampered SAML responses. * Fixed session cookie handling during SSO and Apple MDM SSO flows. * **Refactor** * Replaced custom SAML implementation with the crewjam/saml library for improved reliability. * Simplified SAML metadata parsing and session store management. * Streamlined SSO authorization request and response processing. * Removed deprecated fields and redundant code related to SSO. * **Documentation** * Updated testing and local development docs with clearer instructions for SSO and IdP-initiated login. * **Chores** * Upgraded dependencies including crewjam/saml and related packages. * Cleaned up tests and configuration by removing deprecated fields and unused imports. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-07 18:13:46 +00:00
github.com/beevik/etree v1.5.0
Fix a flaky integration test (#9382)
2023-01-17 20:33:27 +00:00
github.com/beevik/ntp v0.3.0
fix go mod conflicts
2024-04-30 10:42:11 +00:00
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
tool to perform touchless MDM migrations (#18151) This started as a proof of concept that was later successfully used to perform a touchless migration. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] Manual QA for all new/changed functionality --------- Co-authored-by: Zach Wasserman <zach@fleetdm.com>
2024-10-08 12:48:06 +00:00
github.com/boltdb/bolt v1.3.1
Fleet server now accepts arguments via stdin (#21124) #21038 Fleet server now accepts arguments via stdin. This is useful for passing secrets that you don't want to expose as env vars, in the command line, or in the config file. Demo: https://www.loom.com/share/c8b4dc6ae6ef4182bc812d7f43423f4d # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] Added/updated tests - [x] Manual QA for all new/changed functionality
2024-08-07 13:17:14 +00:00
github.com/briandowns/spinner v1.23.1
Updated OpenTelemetry dependencies to latest. (#23186) #23183 Updated OpenTelemetry libraries as part of research into error logging for orbit. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Manual QA for all new/changed functionality
2024-10-25 14:43:32 +00:00
github.com/cavaliergopher/rpm v1.2.0
Bump github.com/cenkalti/backoff (#7722) Bumps [github.com/cenkalti/backoff](https://github.com/cenkalti/backoff) from 2.1.1+incompatible to 2.2.1+incompatible. - [Release notes](https://github.com/cenkalti/backoff/releases) - [Commits](https://github.com/cenkalti/backoff/compare/v2.1.1...v2.2.1) --- updated-dependencies: - dependency-name: github.com/cenkalti/backoff dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-13 23:29:15 +00:00
github.com/cenkalti/backoff v2.2.1+incompatible
Bump github.com/docker/docker from 24.0.9+incompatible to 26.1.4+incompatible (#20839)
2024-07-30 18:47:21 +00:00
github.com/cenkalti/backoff/v4 v4.3.0
Add Kolide osquery tables
2023-11-02 02:11:35 +00:00
github.com/clbanning/mxj v1.8.4
Add containerd_containers table to fleetd (#29384) # Checklist for submitter Implementation for #28315 <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added/updated automated tests (automated testing seemed infeasible) - [x] Manual QA for all new/changed functionality (tested on Ubuntu 24) - For Orbit and Fleet Desktop changes: - [x] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)). - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. (tested on Ubuntu 24, code does not compile on other platforms)
2025-05-27 17:55:38 +00:00
github.com/containerd/containerd v1.7.27
Replace home-made SAML implementation with https://github.com/crewjam/saml (#28486) For https://github.com/fleetdm/confidential/issues/9931. [Here](https://github.com/fleetdm/fleet/blob/ec3e8edbdc3f1b4220ada22c8290dbf0237ce1ba/docs/Contributing/Testing-and-local-development.md?plain=1#L339)'s how to test SAML locally with SimpleSAML. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved SSO and SAML integration with enhanced session management using secure cookies. * Added support for IdP-initiated login flows. * Introduced new tests covering SSO login flows, metadata handling, and error scenarios. * **Bug Fixes** * Enhanced validation and error handling for invalid or tampered SAML responses. * Fixed session cookie handling during SSO and Apple MDM SSO flows. * **Refactor** * Replaced custom SAML implementation with the crewjam/saml library for improved reliability. * Simplified SAML metadata parsing and session store management. * Streamlined SSO authorization request and response processing. * Removed deprecated fields and redundant code related to SSO. * **Documentation** * Updated testing and local development docs with clearer instructions for SSO and IdP-initiated login. * **Chores** * Upgraded dependencies including crewjam/saml and related packages. * Cleaned up tests and configuration by removing deprecated fields and unused imports. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-07 18:13:46 +00:00
github.com/crewjam/saml v0.5.1
Enroll secret in macOS keychain and Windows Credential Manager (#16068) #13832 For macOS hosts, fleetd now stores and retrieves enroll secret from macOS keychain. - this feature must use the official signed and notarized version of fleetd - for contributors, this feature can disabled with either: - fleetctl package flag: --disable-keystore - fleetd runtime flag: --disable-keystore This feature does not cover the MDM usecase where enroll secret is stored in the MDM profile. This usecase will hopefully be worked on next sprint with the MDM team. For Windows hosts, fleetd now stores and retrieves enroll secret from Windows Credential Manager. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Added/updated tests - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [x] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2024-01-16 12:51:37 +00:00
github.com/danieljoos/wincred v1.2.1
Revert "Bump github.com/open-policy-agent/opa from 0.44.0 to 0.68.0" (#25348) Reverts fleetdm/fleet#22253
2025-01-10 21:12:06 +00:00
github.com/davecgh/go-spew v1.1.1
update to go1.22.3 + dependencies (#19142) For #16795, this: - Updates Go to go1.22.3 - Per https://github.com/fleetdm/fleet/issues/16795#issuecomment-2100450618, I also ran the following to update the versions requested by @getvictor ``` go get github.com/kataras/golog@v0.1.12 go get github.com/kataras/iris/v12@v12.2.11 go get github.com/sethvargo/go-password@v0.3.0 ``` **Notes** After this is merged people will need to update their Go version. I use gvm and I did it like: ``` $ gvm install go1.22.3 $ gvm use go1.22.3 --default ``` **Relevant changes** The release notes mention: > Previously, the variables declared by a “for” loop were created once > and updated by each iteration. In Go 1.22, each iteration of the loop > creates new variables, to avoid accidental sharing bugs. However, we already have a lint rule (see https://github.com/fleetdm/fleet/pull/13877) for this scenario, so it shouldn't affect us.
2024-05-23 19:23:38 +00:00
github.com/dgraph-io/badger/v2 v2.2007.4
Ingest pending MDM hosts (#9065) Co-authored-by @roperzh
2022-12-26 21:32:39 +00:00
github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e
Bump github.com/docker/docker from 26.1.5+incompatible to 28.0.0+incompatible (#31918)
2025-08-14 17:47:54 +00:00
github.com/docker/docker v28.0.0+incompatible
Friday cleanup `ld: warning: ignoring duplicate libraries: '-lproc'` (#18581) To get rid of the warning: ``` ld: warning: ignoring duplicate libraries: '-lproc' ``` See https://github.com/elastic/go-sysinfo/releases/tag/v1.11.2. ``` go mod why github.com/elastic/go-sysinfo # github.com/elastic/go-sysinfo github.com/fleetdm/fleet/v4/server/contexts/ctxerr go.elastic.co/apm/v2 github.com/elastic/go-sysinfo ``` I ran: ``` go get github.com/elastic/go-sysinfo@v1.11.2 go mod tidy ```
2024-05-28 13:31:09 +00:00
github.com/docker/go-units v0.5.0
Implement `fleetctl updates rotate` (#2831) Add support for updating keys used in the TUF update system.
2021-11-15 18:01:48 +00:00
github.com/doug-martin/goqu/v9 v9.18.0
Migrate dependencies to go modules (#2094) These changes should be transparent to users and developers. Thanks to @davepgreene who made the first stab at this.
2019-08-13 17:32:23 +00:00
github.com/e-dard/netbug v0.0.0-20151029172837-e64d308a0b20
Bump github.com/elazarl/go-bindata-assetfs from 1.0.0 to 1.0.1 (#7742) Bumps [github.com/elazarl/go-bindata-assetfs](https://github.com/elazarl/go-bindata-assetfs) from 1.0.0 to 1.0.1. - [Release notes](https://github.com/elazarl/go-bindata-assetfs/releases) - [Changelog](https://github.com/elazarl/go-bindata-assetfs/blob/master/.goreleaser.yml) - [Commits](https://github.com/elazarl/go-bindata-assetfs/compare/v1.0.0...v1.0.1) --- updated-dependencies: - dependency-name: github.com/elazarl/go-bindata-assetfs dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-14 10:47:34 +00:00
github.com/elazarl/go-bindata-assetfs v1.0.1
Use go 1.24 new tool feature (#27765) Release notes: https://tip.golang.org/doc/go1.24 > Go modules can now track executable dependencies using tool directives in go.mod. This removes the need for the previous workaround of adding tools as blank imports to a file conventionally named “tools.go”. The go tool command can now run these tools in addition to tools shipped with the Go distribution. For more information see [the documentation](https://tip.golang.org/doc/modules/managing-dependencies#tools). The new -tool flag for go get causes a tool directive to be added to the current module for named packages in addition to adding require directives. I ran: ``` go get -tool github.com/fleetdm/fleet/v4/server/goose go get -tool github.com/kevinburke/go-bindata go get -tool github.com/quasilyte/go-ruleguard/dsl go rm tools.go go mod tidy ``` `make deps-go` was failing in CI because of the removal of `tools.go` (my guess is that `go get .` was a nop because there was nothing in `.` to download). So, taking the chance of removing `deps-go` because `go` will download packages during the build process. AFAICS there's no need to download everything beforehand.
2025-04-07 14:12:05 +00:00
github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8
Migrate logic from `nvdtools` into Fleet (#18244) ## Addresses #15999 - [x] Added/updated tests - [ ] Manual QA for all new/changed functionality --------- Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
2024-04-24 22:25:59 +00:00
github.com/facebookincubator/flog v0.0.0-20190930132826-d2511d0ce33c
Bump github.com/hashicorp/go-retryablehttp from 0.6.8 to 0.7.7 (#19981) Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.6.8 to 0.7.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md">github.com/hashicorp/go-retryablehttp's changelog</a>.</em></p> <blockquote> <h2>0.7.7 (May 30, 2024)</h2> <p>BUG FIXES:</p> <ul> <li>client: avoid potentially leaking URL-embedded basic authentication credentials in logs (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/158">#158</a>)</li> </ul> <h2>0.7.6 (May 9, 2024)</h2> <p>ENHANCEMENTS:</p> <ul> <li>client: support a <code>RetryPrepare</code> function for modifying the request before retrying (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/216">#216</a>)</li> <li>client: support HTTP-date values for <code>Retry-After</code> header value (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/138">#138</a>)</li> <li>client: avoid reading entire body when the body is a <code>*bytes.Reader</code> (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/197">#197</a>)</li> </ul> <p>BUG FIXES:</p> <ul> <li>client: fix a broken check for invalid server certificate in go 1.20+ (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/210">#210</a>)</li> </ul> <h2>0.7.5 (Nov 8, 2023)</h2> <p>BUG FIXES:</p> <ul> <li>client: fixes an issue where the request body is not preserved on temporary redirects or re-established HTTP/2 connections (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/207">#207</a>)</li> </ul> <h2>0.7.4 (Jun 6, 2023)</h2> <p>BUG FIXES:</p> <ul> <li>client: fixing an issue where the Content-Type header wouldn't be sent with an empty payload when using HTTP/2 (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/194">#194</a>)</li> </ul> <h2>0.7.3 (May 15, 2023)</h2> <p>Initial release</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/1542b31176d3973a6ecbc06c05a2d0df89b59afb"><code>1542b31</code></a> v0.7.7</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/defb9f441dcf67a2a56fae733482836ea83349ac"><code>defb9f4</code></a> v0.7.7</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a"><code>a99f07b</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/158">#158</a> from dany74q/danny/redacted-url-in-logs</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/8a28c574da4098c0612fe1c7135f1f6de113d411"><code>8a28c57</code></a> Merge branch 'main' into danny/redacted-url-in-logs</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/86e852df43aa0d94150c4629d74e5116d1ff3348"><code>86e852d</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/227">#227</a> from hashicorp/dependabot/github_actions/actions/chec...</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/47fe99e6460cddc5f433aad2b54dcf32281f8a53"><code>47fe99e</code></a> Bump actions/checkout from 4.1.5 to 4.1.6</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/490fc06be0931548d3523a4245d15e9dc5d9214d"><code>490fc06</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/226">#226</a> from testwill/ioutil</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/f3e9417dbfcd0dc2b4a02a1dfdeb75f1e636b692"><code>f3e9417</code></a> chore: remove refs to deprecated io/ioutil</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/d969eaa9c97860482749df718a35b4a269361055"><code>d969eaa</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/225">#225</a> from hashicorp/manicminer-patch-2</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/2ad8ed4a1d9e632284f6937e91b2f9a1d30e8298"><code>2ad8ed4</code></a> v0.7.6</li> <li>Additional commits viewable in <a href="https://github.com/hashicorp/go-retryablehttp/compare/v0.6.8...v0.7.7">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/go-retryablehttp&package-manager=go_modules&previous-version=0.6.8&new-version=0.7.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-25 13:34:28 +00:00
github.com/fatih/color v1.16.0
Bump github.com/docker/docker from 26.1.5+incompatible to 28.0.0+incompatible (#31918)
2025-08-14 17:47:54 +00:00
github.com/foxboron/go-tpm-keyfiles v0.0.0-20250520203025-c3c3a4ec1653
Bump github.com/getsentry/sentry-go from 0.12.0 to 0.18.0 (#9793) Bumps [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) from 0.12.0 to 0.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-go/releases">github.com/getsentry/sentry-go's releases</a>.</em></p> <blockquote> <h2>0.18.0</h2> <p>The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.18.0. This release contains initial support for <a href="https://opentelemetry.io/">OpenTelemetry</a> and various other bug fixes and improvements.</p> <p><strong>Note</strong>: This is the last release supporting Go 1.17.</p> <h3>Features</h3> <ul> <li> <p>Initial support for <a href="https://opentelemetry.io/">OpenTelemetry</a>. You can now send all your OpenTelemetry spans to Sentry.</p> <p>Install the <code>otel</code> module</p> <pre lang="bash"><code>go get github.com/getsentry/sentry-go \ github.com/getsentry/sentry-go/otel </code></pre> <p>Configure the Sentry and OpenTelemetry SDKs</p> <pre lang="go"><code>import ( &quot;go.opentelemetry.io/otel&quot; sdktrace &quot;go.opentelemetry.io/otel/sdk/trace&quot; &quot;github.com/getsentry/sentry-go&quot; &quot;github.com/getsentry/sentry-go/otel&quot; // ... ) <p>// Initlaize the Sentry SDK sentry.Init(sentry.ClientOptions{ Dsn: &quot;<strong>DSN</strong>&quot;, EnableTracing: true, TracesSampleRate: 1.0, })</p> <p>// Set up the Sentry span processor tp := sdktrace.NewTracerProvider( sdktrace.WithSpanProcessor(sentryotel.NewSentrySpanProcessor()), // ... ) otel.SetTracerProvider(tp)</p> <p>// Set up the Sentry propagator otel.SetTextMapPropagator(sentryotel.NewSentryPropagator()) </code></pre></p> <p>You can read more about using OpenTelemetry with Sentry in our <a href="https://docs.sentry.io/platforms/go/performance/instrumentation/opentelemetry/">docs</a>.</p> </li> </ul> <h3>Bug Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md">github.com/getsentry/sentry-go's changelog</a>.</em></p> <blockquote> <h2>0.18.0</h2> <p>The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.18.0. This release contains initial support for <a href="https://opentelemetry.io/">OpenTelemetry</a> and various other bug fixes and improvements.</p> <p><strong>Note</strong>: This is the last release supporting Go 1.17.</p> <h3>Features</h3> <ul> <li> <p>Initial support for <a href="https://opentelemetry.io/">OpenTelemetry</a>. You can now send all your OpenTelemetry spans to Sentry.</p> <p>Install the <code>otel</code> module</p> <pre lang="bash"><code>go get github.com/getsentry/sentry-go \ github.com/getsentry/sentry-go/otel </code></pre> <p>Configure the Sentry and OpenTelemetry SDKs</p> <pre lang="go"><code>import ( &quot;go.opentelemetry.io/otel&quot; sdktrace &quot;go.opentelemetry.io/otel/sdk/trace&quot; &quot;github.com/getsentry/sentry-go&quot; &quot;github.com/getsentry/sentry-go/otel&quot; // ... ) <p>// Initlaize the Sentry SDK sentry.Init(sentry.ClientOptions{ Dsn: &quot;<strong>DSN</strong>&quot;, EnableTracing: true, TracesSampleRate: 1.0, })</p> <p>// Set up the Sentry span processor tp := sdktrace.NewTracerProvider( sdktrace.WithSpanProcessor(sentryotel.NewSentrySpanProcessor()), // ... ) otel.SetTracerProvider(tp)</p> <p>// Set up the Sentry propagator otel.SetTextMapPropagator(sentryotel.NewSentryPropagator()) </code></pre></p> <p>You can read more about using OpenTelemetry with Sentry in our <a href="https://docs.sentry.io/platforms/go/performance/instrumentation/opentelemetry/">docs</a>.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/getsentry/sentry-go/commit/4b97c8e66159e9da864d79c502e4cbf59eb38031"><code>4b97c8e</code></a> release: 0.18.0</li> <li><a href="https://github.com/getsentry/sentry-go/commit/79724631e3ad22e2c3a167dfa13936e4e4a6d5d0"><code>7972463</code></a> fix(release): Bump root module version in submodules (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/576">#576</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/612c16704968c81c84c2479cd9d74b4373a0e62a"><code>612c167</code></a> fix(build): Tidy otel submodule (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/575">#575</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/3ec394335539ae0d0de0e87c012c5a845ce8849f"><code>3ec3943</code></a> doc: Prepare 0.18.0 (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/572">#572</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/bb6e2bdbf0d32bf4645ab8a29fed6f3183ddfee7"><code>bb6e2bd</code></a> fix(otel): Use vendored bagggage implementation in propagator (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/573">#573</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/3964ecefd0682870f9e1891cf85231db52be6c07"><code>3964ece</code></a> fix(baggage): Update baggage parsing and encoding in vendored otel package (#...</li> <li><a href="https://github.com/getsentry/sentry-go/commit/ef3a838eef937b2d67445dbe70a3fae83e4ec718"><code>ef3a838</code></a> test: Add Codecov configuration file (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/569">#569</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/de904d6e9788a7e2c165bd4ec4dec06ea43c38b5"><code>de904d6</code></a> fix(otel): Require otel 1.11.0 and higher (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/567">#567</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/d0a2aa3ebdba03d70bf5228c585cae1f2a800424"><code>d0a2aa3</code></a> fix: Create a frozen DSC when calling ToBaggage (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/566">#566</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/fb7618028bababd9197569610a87e59bdacb037e"><code>fb76180</code></a> release: Update .craft.yml to be ready for otel submodule release (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/565">#565</a>)</li> <li>Additional commits viewable in <a href="https://github.com/getsentry/sentry-go/compare/v0.12.0...v0.18.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/getsentry/sentry-go&package-manager=go_modules&previous-version=0.12.0&new-version=0.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-28 02:24:03 +00:00
github.com/getsentry/sentry-go v0.18.0
Migrate dependencies to go modules (#2094) These changes should be transparent to users and developers. Thanks to @davepgreene who made the first stab at this.
2019-08-13 17:32:23 +00:00
github.com/ghodss/yaml v1.0.0
Fix uploading signed apple mobileconfig profiles (#18482) relates to #18389 This fixes an issue with some signed apple mobileconfig profiles were not able to be uploaded. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Manual QA for all new/changed functionality
2024-04-25 16:09:53 +00:00
github.com/github/smimesign v0.2.0
Bump github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#25280)
2025-01-09 18:09:49 +00:00
github.com/go-git/go-git/v5 v5.13.0
Add Kolide osquery tables
2023-11-02 02:11:35 +00:00
github.com/go-ini/ini v1.67.0
Hook up Android fleetdm.com/proxy (#29645) For #26519 This PR allows Fleet server to use Android with either fleetdm.com proxy or locally. It also removes the Android feature flag from the backend. The frontend changes and proxy API documentation will be in separate PRs. Updated contributor docs: https://github.com/fleetdm/fleet/pull/29880/files Integration tests are missing and tracked as a separate issue: https://github.com/fleetdm/fleet/issues/27080 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality
2025-06-13 00:42:15 +00:00
github.com/go-json-experiment/json v0.0.0-20250517221953-25912455fbc8
Bump github.com/go-kit/kit from 0.9.0 to 0.12.0 (#7735) Bumps [github.com/go-kit/kit](https://github.com/go-kit/kit) from 0.9.0 to 0.12.0. - [Release notes](https://github.com/go-kit/kit/releases) - [Commits](https://github.com/go-kit/kit/compare/v0.9.0...v0.12.0) --- updated-dependencies: - dependency-name: github.com/go-kit/kit dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-13 21:21:23 +00:00
github.com/go-kit/kit v0.12.0
Bump github.com/go-kit/log from 0.2.0 to 0.2.1 (#10187) Bumps [github.com/go-kit/log](https://github.com/go-kit/log) from 0.2.0 to 0.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-kit/log/releases">github.com/go-kit/log's releases</a>.</em></p> <blockquote> <h2>v0.2.1</h2> <p>This release fixes a few small bugs and adds <code>level.Parse</code> which allows levels to be set by a string input from e.g. flags or environment variables. Thanks, <a href="https://github.com/mcosta74"><code>@​mcosta74</code></a>!</p> <h2>What's Changed</h2> <ul> <li>fix safeError &amp; safeString for json format by <a href="https://github.com/dwiyanr"><code>@​dwiyanr</code></a> in <a href="https://github-redirect.dependabot.com/go-kit/log/pull/20">go-kit/log#20</a></li> <li>Update CI and add badges to README by <a href="https://github.com/ChrisHines"><code>@​ChrisHines</code></a> in <a href="https://github-redirect.dependabot.com/go-kit/log/pull/21">go-kit/log#21</a></li> <li>Allow to configure allowed levels by string value by <a href="https://github.com/mcosta74"><code>@​mcosta74</code></a> in <a href="https://github-redirect.dependabot.com/go-kit/log/pull/22">go-kit/log#22</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dwiyanr"><code>@​dwiyanr</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/go-kit/log/pull/20">go-kit/log#20</a></li> <li><a href="https://github.com/mcosta74"><code>@​mcosta74</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/go-kit/log/pull/22">go-kit/log#22</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-kit/log/compare/v0.2.0...v0.2.1">https://github.com/go-kit/log/compare/v0.2.0...v0.2.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-kit/log/commit/0b69c7049332e99c25d5fd0f4d08317cfe45e7d8"><code>0b69c70</code></a> Allow to configure allowed levels by string value (<a href="https://github-redirect.dependabot.com/go-kit/log/issues/22">#22</a>)</li> <li><a href="https://github.com/go-kit/log/commit/3752ef76bbc4d0e88bff071af7339629c1a8c0e4"><code>3752ef7</code></a> Update CI and add badges to README (<a href="https://github-redirect.dependabot.com/go-kit/log/issues/21">#21</a>)</li> <li><a href="https://github.com/go-kit/log/commit/2b8dc2beb3395f30c74b00b2f585b7e9a3fea8d1"><code>2b8dc2b</code></a> fix safeError &amp; safeString for json format (<a href="https://github-redirect.dependabot.com/go-kit/log/issues/20">#20</a>)</li> <li>See full diff in <a href="https://github.com/go-kit/log/compare/v0.2.0...v0.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-kit/log&package-manager=go_modules&previous-version=0.2.0&new-version=0.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-01 01:26:57 +00:00
github.com/go-kit/log v0.2.1
Update `facebookincubator/nvdtools` package to fix false positive (#14798) #14543 Python's certifi package is ingested with the following version string: `2023.7.22`. The NVD dataset uses the following versioning: `2023.07.22`. This PR updates the nvdtools package. This is the fix in nvdtools that fixes this exact false positive: https://github.com/facebookincubator/nvdtools/commit/c0d18738cde5864576f073af99669edc92e87fb4 - [X] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md)~ - ~[ ] Documented any permissions changes (docs/Using Fleet/manage-access.md)~ - ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)~ - ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.~ - ~[ ] Added/updated tests~ - [X] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.~ - ~[ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-10-30 20:20:28 +00:00
github.com/go-ole/go-ole v1.2.6
Feat 1817 add iam auth to mysql and redis (#32488) for #1817 # Details This PR gives Fleet servers the ability to connect to RDS MySQL and Elasticache Redis via AWS [Identity and Access Management (IAM)](https://aws.amazon.com/iam/). It is based almost entirely on the work of @titanous, branched from his [original pull request](https://github.com/fleetdm/fleet/pull/31075). The main differences between his branch and this are: 1. Removal of auto-detection of AWS region (and cache name for Elasticache) in favor of specifying these values in configuration. The auto-detection is admittedly handy but parsing AWS host URLs is not considered a best practice. 2. Relying on the existence of these new configs to determine whether or not to connect via IAM. This sidesteps a thorny issue of whether to try an IAM-based Elasticache connection when a password is not supplied, since this is technically a valid setup. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually - besides using @titanous's excellent test tool, I verified the following end-to-end: - [X] regular (non RDS) MySQL connection - [X] RDS MySQL connection using username/password - [X] RDS MySQL connection using IAM (no role) - [X] RDS MySQL connection using IAM (assuming role) - [X] regular (non Elasticache) Redis connection - [X] Elasticache Redis connection using username/password - [X] Elasticache Redis connection using NO password (without IAM) - [X] Elasticache Redis connection using IAM (no role) - [X] Elasticache Redis connection using IAM (assuming role) --------- Co-authored-by: Jonathan Rudenberg <jonathan@titanous.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2025-09-04 15:08:47 +00:00
github.com/go-sql-driver/mysql v1.9.1
Add public ip to hosts & derive geolocation when rendering host (#4652) * geoip wip * return nil if ip is empty string or if ParseIP returns nil * add ui component to render geolocation if available, address PR feedback * render public ip if available * add changes file, document geoip in deployment guide * update rest-api docs
2022-03-21 16:29:52 +00:00
github.com/gocarina/gocsv v0.0.0-20220310154401-d4df709ca055
Make desktop server display manager restart (#26526) For #25616 # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - For Orbit and Fleet Desktop changes: - [X] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - Tested on macOS, Windows, Ubuntu, Fedora (w/ and without system tray) and Debian (w/ and without system tray) ## Details This PR addresses the issue that on Ubuntu, if a user restarts their display manager (e.g. with `sudo systemctl restart gdm3`), the Fleet Desktop tray icon disappears and doesn't come back. The solution in this PR is to add a function that runs in a loop and checks whether the tray icon still exists, and if not, kills the Fleet Desktop process. The parent Orbit process already has code to restart the desktop if it dies. We also update the Orbit checker to run every 15 seconds, to limit the delay in the icon coming back after a restart. Also included in this PR is a rename from `desktop_unix.go` to `desktop_linux.go`, which will be used automatically for linux builds, and a new `desktop_darwin.go` for macos builds, and the removal of redundant build directives for all.
2025-02-24 16:14:45 +00:00
github.com/godbus/dbus/v5 v5.1.0
Bump golang.org/x/net from 0.33.0 to 0.36.0 (#27094) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.33.0 to 0.36.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/85d1d54551b68719346cb9fec24b911da4e452a1"><code>85d1d54</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/cde1dda944dcf6350753df966bb5bda87a544842"><code>cde1dda</code></a> proxy, http/httpproxy: do not mismatch IPv6 zone ids against hosts</li> <li><a href="https://github.com/golang/net/commit/fe7f0391aa994a401c82d829183c1efab7a64df4"><code>fe7f039</code></a> publicsuffix: spruce up code gen and speed up PublicSuffix</li> <li><a href="https://github.com/golang/net/commit/459513d1f8abff01b4854c93ff0bff7e87985a0a"><code>459513d</code></a> internal/http3: move more common stream processing to genericConn</li> <li><a href="https://github.com/golang/net/commit/aad0180cad195ab7bcd14347e7ab51bece53f61d"><code>aad0180</code></a> http2: fix flakiness from t.Log when GOOS=js</li> <li><a href="https://github.com/golang/net/commit/b73e5746f64471c22097f07593643a743e7cfb0f"><code>b73e574</code></a> http2: don't log expected errors from writing invalid trailers</li> <li><a href="https://github.com/golang/net/commit/5f45c776a9c4d415cbe67d6c22c06fd704f8c9f1"><code>5f45c77</code></a> internal/http3: make read-data tests usable for server handlers</li> <li><a href="https://github.com/golang/net/commit/43c2540165a4d1bc9a81e06a86eb1e22ece64145"><code>43c2540</code></a> http2, internal/httpcommon: reject userinfo in :authority</li> <li><a href="https://github.com/golang/net/commit/1d78a085008d9fedfe3f303591058325f99727d7"><code>1d78a08</code></a> http2, internal/httpcommon: factor out server header logic for h2/h3</li> <li><a href="https://github.com/golang/net/commit/0d7dc54a591c12b4bd03bcd745024178d03d9218"><code>0d7dc54</code></a> quic: add Conn.ConnectionState</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.33.0...v0.36.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/net&package-manager=go_modules&previous-version=0.33.0&new-version=0.36.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-13 10:18:30 +00:00
github.com/gofrs/flock v0.12.1
Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#27426)
2025-03-25 16:51:59 +00:00
github.com/golang-jwt/jwt/v4 v4.5.2
Move nanodep dependency in monorepo (#16984)
2024-02-26 15:26:00 +00:00
github.com/gomodule/oauth1 v0.2.0
Bump github.com/gomodule/redigo from 1.8.5 to 1.8.9 (#7721) Bumps [github.com/gomodule/redigo](https://github.com/gomodule/redigo) from 1.8.5 to 1.8.9. - [Release notes](https://github.com/gomodule/redigo/releases) - [Commits](https://github.com/gomodule/redigo/compare/v1.8.5...v1.8.9) --- updated-dependencies: - dependency-name: github.com/gomodule/redigo dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-13 14:23:24 +00:00
github.com/gomodule/redigo v1.8.9
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/google/go-cmp v0.7.0
Issue 1435 software to cpe (#1488) * WIP * WIP * Make path optional and fix tests * Add first generate * Move to nvd package * remove replace * Re-add replace * It's path, not file name * Change how db path is set and use etag * Fix typos * Make db generation faster * Remove quotes * Doesn't like comments * Samitize etag and save to file * Refactor some things and improve writing of etagenv * Compress file and truncate amount of items for faster testing * Remove quotes * Try to improve performance * Ignore truncate error if not exists * Minor cleanup and make sqlite have cpe prefix * Simplify code and test sync * Add VCR for sync test * Check for nvdRelease nil * Add test for the actual translation * Address review comments * Rename generate command because we'll have a cve one too * Move to its own dir * Address review comments
2021-07-29 16:10:34 +00:00
github.com/google/go-github/v37 v37.0.0
Bump github.com/docker/docker from 26.1.5+incompatible to 28.0.0+incompatible (#31918)
2025-08-14 17:47:54 +00:00
github.com/google/go-tpm v0.9.5
Extract metadata from installers part 2 (#18608)
2024-04-30 15:20:53 +00:00
github.com/google/uuid v1.6.0
Add initial Arch Linux support (#33096) For #32859. We can ignore the "Dependency review" failure in [CVE-2023-32698](https://github.com/advisories/GHSA-w7jw-q4fg-qc4c) because we already have the rules to ignore it (we are not vulnerable). I'm not updating nfpm to latest because it would require further changes on all deb/rpm generation (source code breaking changes on the golang interfaces). --- <img width="448" height="151" alt="screenshot-2025-09-11_08-38-20" src="https://github.com/user-attachments/assets/4c00b960-568a-48d9-8098-308c8ab8916f" /> <img width="391" height="73" alt="screenshot-2025-09-11_08-37-40" src="https://github.com/user-attachments/assets/dec6ea22-31f8-4930-b067-0b04b4ec2b5f" /> <img width="759" height="428" alt="Image" src="https://github.com/user-attachments/assets/0a76d070-4709-4a35-8e6e-caf869473d28" /> <img width="1178" height="634" alt="Image" src="https://github.com/user-attachments/assets/98e6fa2a-ba07-4a55-81aa-ad747f1c57b9" /> <img width="1388" height="830" alt="Image" src="https://github.com/user-attachments/assets/19d36bad-d01d-4130-b271-38bea2534833" /> <img width="933" height="930" alt="Image" src="https://github.com/user-attachments/assets/1d6a369b-65d7-46a4-98a6-e6f0b29be2c8" /> <img width="2241" height="693" alt="Image" src="https://github.com/user-attachments/assets/d8f98e97-f027-4c1c-ae5d-c4fa3b592a20" /> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [X] QA'd all new/changed functionality manually
2025-09-18 21:55:31 +00:00
github.com/goreleaser/nfpm/v2 v2.20.0
Updated OpenTelemetry dependencies to latest. (#23186) #23183 Updated OpenTelemetry libraries as part of research into error logging for orbit. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Manual QA for all new/changed functionality
2024-10-25 14:43:32 +00:00
github.com/gorilla/mux v1.8.1
update to go1.22.3 + dependencies (#19142) For #16795, this: - Updates Go to go1.22.3 - Per https://github.com/fleetdm/fleet/issues/16795#issuecomment-2100450618, I also ran the following to update the versions requested by @getvictor ``` go get github.com/kataras/golog@v0.1.12 go get github.com/kataras/iris/v12@v12.2.11 go get github.com/sethvargo/go-password@v0.3.0 ``` **Notes** After this is merged people will need to update their Go version. I use gvm and I did it like: ``` $ gvm install go1.22.3 $ gvm use go1.22.3 --default ``` **Relevant changes** The release notes mention: > Previously, the variables declared by a “for” loop were created once > and updated by each iteration. In Go 1.22, each iteration of the loop > creates new variables, to avoid accidental sharing bugs. However, we already have a lint rule (see https://github.com/fleetdm/fleet/pull/13877) for this scenario, so it shouldn't affect us.
2024-05-23 19:23:38 +00:00
github.com/gorilla/websocket v1.5.1
Add pretty-printing option for query results (#4) Use --pretty to enable this feature. This will likely break on non-ANSI terminals.
2020-11-04 17:56:57 +00:00
github.com/gosuri/uilive v0.0.4
feat: move scep dependency inside the monorepo (#16988) Following the pattern set up by Martin and Lucas for similar PRs. Can be reviewed by commits: 1. move scep directory into monorepo 2. update import paths 3. update go.mod, go.sum 4. fix golint errors in scep package 5. skip a failing test that's been broken for a while 6. fix that failing test # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Manual QA for all new/changed functionality Also verified that our test suite runs the `scep` tests.
2024-02-22 18:13:46 +00:00
github.com/groob/finalizer v0.0.0-20170707115354-4c2ed49aabda
Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#30388) Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) from 2.2.1 to 2.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-viper/mapstructure/releases">github.com/go-viper/mapstructure/v2's releases</a>.</em></p> <blockquote> <h2>v2.3.0</h2> <h2>What's Changed</h2> <ul> <li>build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/46">go-viper/mapstructure#46</a></li> <li>build(deps): bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/47">go-viper/mapstructure#47</a></li> <li>[enhancement] Add check for <code>reflect.Value</code> in <code>ComposeDecodeHookFunc</code> by <a href="https://github.com/mahadzaryab1"><code>@​mahadzaryab1</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/52">go-viper/mapstructure#52</a></li> <li>build(deps): bump actions/setup-go from 5.0.2 to 5.1.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/51">go-viper/mapstructure#51</a></li> <li>build(deps): bump actions/checkout from 4.2.0 to 4.2.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/50">go-viper/mapstructure#50</a></li> <li>build(deps): bump actions/setup-go from 5.1.0 to 5.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/55">go-viper/mapstructure#55</a></li> <li>build(deps): bump actions/setup-go from 5.2.0 to 5.3.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/58">go-viper/mapstructure#58</a></li> <li>ci: add Go 1.24 to the test matrix by <a href="https://github.com/sagikazarmark"><code>@​sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/74">go-viper/mapstructure#74</a></li> <li>build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/72">go-viper/mapstructure#72</a></li> <li>build(deps): bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/76">go-viper/mapstructure#76</a></li> <li>build(deps): bump actions/setup-go from 5.3.0 to 5.4.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/78">go-viper/mapstructure#78</a></li> <li>feat: add decode hook for netip.Prefix by <a href="https://github.com/tklauser"><code>@​tklauser</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/85">go-viper/mapstructure#85</a></li> <li>Updates by <a href="https://github.com/sagikazarmark"><code>@​sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/86">go-viper/mapstructure#86</a></li> <li>build(deps): bump github/codeql-action from 2.13.4 to 3.28.15 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/87">go-viper/mapstructure#87</a></li> <li>build(deps): bump actions/setup-go from 5.4.0 to 5.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/93">go-viper/mapstructure#93</a></li> <li>build(deps): bump github/codeql-action from 3.28.15 to 3.28.17 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/92">go-viper/mapstructure#92</a></li> <li>build(deps): bump github/codeql-action from 3.28.17 to 3.28.19 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/97">go-viper/mapstructure#97</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/96">go-viper/mapstructure#96</a></li> <li>Update README.md by <a href="https://github.com/peczenyj"><code>@​peczenyj</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/90">go-viper/mapstructure#90</a></li> <li>Add omitzero tag. by <a href="https://github.com/Crystalix007"><code>@​Crystalix007</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/98">go-viper/mapstructure#98</a></li> <li>Use error structs instead of duplicated strings by <a href="https://github.com/m1k1o"><code>@​m1k1o</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/102">go-viper/mapstructure#102</a></li> <li>build(deps): bump github/codeql-action from 3.28.19 to 3.29.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/101">go-viper/mapstructure#101</a></li> <li>feat: add common error interface by <a href="https://github.com/sagikazarmark"><code>@​sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/105">go-viper/mapstructure#105</a></li> <li>update linter by <a href="https://github.com/sagikazarmark"><code>@​sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/106">go-viper/mapstructure#106</a></li> <li>Feature allow unset pointer by <a href="https://github.com/rostislaved"><code>@​rostislaved</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/80">go-viper/mapstructure#80</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tklauser"><code>@​tklauser</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/85">go-viper/mapstructure#85</a></li> <li><a href="https://github.com/peczenyj"><code>@​peczenyj</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/90">go-viper/mapstructure#90</a></li> <li><a href="https://github.com/Crystalix007"><code>@​Crystalix007</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/98">go-viper/mapstructure#98</a></li> <li><a href="https://github.com/rostislaved"><code>@​rostislaved</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/80">go-viper/mapstructure#80</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0">https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-viper/mapstructure/commit/8c61ec1924fcfa522f9fc6b4618c672db61d1a38"><code>8c61ec1</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/80">#80</a> from rostislaved/feature-allow-unset-pointer</li> <li><a href="https://github.com/go-viper/mapstructure/commit/df765f469ad16a1996fd0f0ae6a32b20535b966a"><code>df765f4</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/106">#106</a> from go-viper/update-linter</li> <li><a href="https://github.com/go-viper/mapstructure/commit/5f34b05aa12639380ef7c2af69eb6f8fd629dbd0"><code>5f34b05</code></a> update linter</li> <li><a href="https://github.com/go-viper/mapstructure/commit/36de1e1d74f55681536097ff8467a8ce952ef183"><code>36de1e1</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/105">#105</a> from go-viper/error-refactor</li> <li><a href="https://github.com/go-viper/mapstructure/commit/6a283a390ee7bc0f9331f58199db234902e0739f"><code>6a283a3</code></a> chore: update error type doc</li> <li><a href="https://github.com/go-viper/mapstructure/commit/599cb73236404c044abcf278a45c3928d7480dd0"><code>599cb73</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/101">#101</a> from go-viper/dependabot/github_actions/github/codeql...</li> <li><a href="https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a"><code>ed3f921</code></a> feat: remove value from error messages</li> <li><a href="https://github.com/go-viper/mapstructure/commit/a3f8b227dcdae324c070d389152837f0aa635f4b"><code>a3f8b22</code></a> revert: error message change</li> <li><a href="https://github.com/go-viper/mapstructure/commit/9661f6d07c319da00ae0508d99df5f3f0c3953bd"><code>9661f6d</code></a> feat: add common error interface</li> <li><a href="https://github.com/go-viper/mapstructure/commit/f12f6c76fe743c8e4cc6465c6a9f16fcd8cede57"><code>f12f6c7</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/102">#102</a> from m1k1o/prettify-errors2</li> <li>Additional commits viewable in <a href="https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-viper/mapstructure/v2&package-manager=go_modules&previous-version=2.2.1&new-version=2.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-27 17:45:01 +00:00
github.com/groob/plist v0.0.0-20220217120414-63fa881b19a5
Bump github.com/open-policy-agent/opa from 0.24.0 to 0.40.0 (#5906) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.24.0 to 0.40.0. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-policy-agent/opa/compare/v0.24.0...v0.40.0) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-05-26 15:15:40 +00:00
github.com/hashicorp/go-multierror v1.1.1
Make creating dirs and files more secure by checking permissions (#1566) * Add safe mkdirall and open * Use secure as much as possible and merge gomodules for orbit to fleet * Improve openfile and mkdirall to check for permissiveness instead of equality * Don't shift * Fix links * Address review comments
2021-08-11 14:02:22 +00:00
github.com/hectane/go-acl v0.0.0-20190604041725-da78bae5fc95
Add new data types and table for Apple MDM config profiles (#9758)
2023-02-09 00:36:20 +00:00
github.com/hillu/go-ntdll v0.0.0-20220801201350-0d23f057ef1f
Update `sockjs-go` package to `v3.0.2` (#11884) In #10957, a customer attempted to run a live query on ~60k devices. We saw that Fleet receives all results from the devices, but stops sending them to the browser. We believe this _might_ be a deadlock (we couldn't confirm this because of lack of access to the Fleet instance itself). We haven't fully confirmed this to be the reason of the hang/missing-results, but it's worth updating because it [fixes a possible deadlock in the package](https://github.com/igm/sockjs-go/releases/tag/v3.0.2). The remaining changes are the result of running `go mod tidy`. - ~[ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information.~ - ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md)~ - ~[ ] Documented any permissions changes~ - ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)~ - ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.~ - ~[ ] Added/updated tests~ - [X] Manual QA for all new/changed functionality - ~For Orbit and Fleet Desktop changes:~ - ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.~ - ~[ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-05-25 11:12:24 +00:00
github.com/igm/sockjs-go/v3 v3.0.2
Fix uploading signed apple mobileconfig profiles (#18482) relates to #18389 This fixes an issue with some signed apple mobileconfig profiles were not able to be uploaded. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Manual QA for all new/changed functionality
2024-04-25 16:09:53 +00:00
github.com/jmoiron/sqlx v1.3.5
Update `sockjs-go` package to `v3.0.2` (#11884) In #10957, a customer attempted to run a live query on ~60k devices. We saw that Fleet receives all results from the devices, but stops sending them to the browser. We believe this _might_ be a deadlock (we couldn't confirm this because of lack of access to the Fleet instance itself). We haven't fully confirmed this to be the reason of the hang/missing-results, but it's worth updating because it [fixes a possible deadlock in the package](https://github.com/igm/sockjs-go/releases/tag/v3.0.2). The remaining changes are the result of running `go mod tidy`. - ~[ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information.~ - ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md)~ - ~[ ] Documented any permissions changes~ - ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)~ - ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.~ - ~[ ] Added/updated tests~ - [X] Manual QA for all new/changed functionality - ~For Orbit and Fleet Desktop changes:~ - ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.~ - ~[ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-05-25 11:12:24 +00:00
github.com/josephspurrier/goversioninfo v1.4.0
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/klauspost/compress v1.18.0
Downgrade `osquery-go` due to panics in Shutdown and add more logging (#15017) #15022 The issue in the package is being fixed here https://github.com/osquery/osquery-go/pull/117 But to not block on that we will downgrade the osquery-go version we use. - ~[ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information.~ - ~[ ] Documented any permissions changes (docs/Using Fleet/manage-access.md)~ - ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)~ - ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.~ - ~[ ] Added/updated tests~ - [ ] Manual QA for all new/changed functionality - ~For Orbit and Fleet Desktop changes:~ - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2023-11-13 21:29:45 +00:00
github.com/kolide/launcher v1.0.12
Move external dependency `goose` to monorepo (#15859) #15555 Probably the best way to review this is commit by commit: - First commit does the actual moving. - Second commit fixes golangci-lint issues (in the least effort way to avoid refactoring or rearrangement of some of the code). - Third commit moves a printf to before the migration step is executed. In the past some customers hitting migration issues (like migration steps hanging or taking long to execute) and wanted to know which one was it. The only way to know was to look at the repository and looking for the next migration after the last one logged. Checks: - [X] Manual QA for all new/changed functionality Manual tests: - `make fleet && make db-reset`. - Adding a new migration via `make migration name=Foobar` and then running `./build/fleet prepare db`. - Enrolling a new device to Fleet (smoke test).
2024-01-02 20:52:00 +00:00
github.com/lib/pq v1.10.9
Upgrade macadmins osquery-extension to v1.2.3 (#23940) This upgrade should fix #21311, and @mostlikelee not sure if there's an issue for the Puppet fix you submitted recently.
2024-11-19 17:54:22 +00:00
github.com/macadmins/osquery-extension v1.2.3
Fix uploading signed apple mobileconfig profiles (#18482) relates to #18389 This fixes an issue with some signed apple mobileconfig profiles were not able to be uploaded. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Manual QA for all new/changed functionality
2024-04-25 16:09:53 +00:00
github.com/mattn/go-sqlite3 v1.14.22
Add Apple MDM functionality (#7940) * WIP * Adding DEP functionality to Fleet * Better organize additional MDM code * Add cmdr.py and amend API paths * Fix lint * Add demo file * Fix demo.md * go mod tidy * Add munki setup to Fleet * Add diagram to demo.md * Add fixes * Update TODOs and demo.md * Fix cmdr.py and add TODO * Add endpoints to demo.md * Add more Munki PoC/demo stuff * WIP * Remove proposals from PoC * Replace prepare commands with fleetctl commands * Update demo.md with current state * Remove config field * Amend demo * Remove Munki setup from MVP-Dogfood * Update demo.md * Add apple mdm commands (#7769) * fleetctl enqueue mdm command * fix deps * Fix build Co-authored-by: Lucas Rodriguez <lucas@fleetdm.com> * Add command to upload installers * go mod tidy * fix subcommands help There is a bug in urfave/cli where help text is not generated properly when subcommands are nested too deep. * Add support for installing apps * Add a way to list enrolled devices * Add dep listing * Rearrange endpoints * Move DEP routine to schedule * Define paths globally * Add a way to list enrollments and installers * Parse device-ids as comma-separated string * Remove unused types * Add simple commands and nest under enqueue-command * Fix simple commands * Add help to enqueue-command * merge apple_mdm database * Fix commands * update nanomdm * Split nanomdm and nanodep schemas * Set 512 MB in memory for upload * Remove empty file * Amend profile * Add sample commands * Add delete installers and fix bug in DEP profile assigning * Add dogfood.md deployment guide * Update schema.sql * Dump schema with MySQL 5 * Set default value for authenticate_at * add tokens to enrollment profiles When a device downloads an MDM enrollment profile, verify the token passed as a query parameter. This ensures untrusted devices don't enroll with our MDM server. - Rename enrollments to enrollment profiles. Enrollments is used by nano to refer to devices that are enrolled with MDM - Rename endpoint /api/<version>/fleet/mdm/apple/enrollments to ../enrollmentprofiles - Generate a token for authentication when creating an enrollment profile - Return unauthorized if token is invalid when downloading an enrollment profile from /api/mdm/apple/enroll?token= * remove mdm apple server url * update docs * make dump-test-schema * Update nanomdm with missing prefix table * Add docs and simplify changes * Add changes file * Add method docs * Fix compile and revert prepare.go changes * Revert migration status check change * Amend comments * Add more docs * Clarify storage of installers * Remove TODO * Remove unused * update dogfood.md * remove cmdr.py * Add authorization tests * Add TODO comment * use kitlog for nano logging * Add yaml tags * Remove unused flag * Remove changes file * Only run DEP routine if MDM is enabled * Add docs to all new exported types * Add docs * more nano logging changes * Fix unintentional removal * more nano logging changes * Fix compile test * Use string for configs and fix config test * Add docs and amend changes * revert changes to basicAuthHandler * remove exported BasicAuthHandler * rename rego authz type * Add more information to dep list * add db tag * update deps * Fix schema * Remove unimplemented Co-authored-by: Michal Nicpon <39177923+michalnicp@users.noreply.github.com> Co-authored-by: Michal Nicpon <michal@fleetdm.com>
2022-10-05 22:53:54 +00:00
github.com/micromdm/micromdm v1.9.0
Replace deprecated pkcs7 package with a maintained fork (#24313)
2024-12-03 16:01:22 +00:00
github.com/micromdm/nanolib v0.2.0
Additional CA validation (#27169) For #26623 - Updated `github.com/groob/plist` to `github.com/micromdm/plist` -- it was renamed - Added validation that restricts DigiCert Fleet variables to `com.apple.security.pkcs12` payloads plus additional restrictions - Added validation that restricts Custom SCEP Fleet variables to `com.apple.security.scep` payloads plus additional restrictions - Enabled multiple CAs (Fleet variables) to be present in an Apple MDM profile. But each CA can only be used once. For example, we can have DigiCert CA and Custom SCEP CA in one Apple profile. # Checklist for submitter - [x] If database migrations are included, checked table schema to confirm autoupdate - For database migrations: - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality
2025-03-19 13:27:55 +00:00
github.com/micromdm/plist v0.2.1
Add MacAdmins tables in Orbit extension (#2140) Uses the extension tables from https://github.com/macadmins/osquery-extension. Co-authored-by: Zach Wasserman <zach@fleetdm.com>
2021-11-16 02:40:53 +00:00
github.com/mitchellh/go-ps v1.0.0
Update to latest gon with notarytool until we find a better solution (#14918) Co-authored-by: Roberto Dip <dip.jesusr@gmail.com>
2023-11-03 23:56:30 +00:00
github.com/mitchellh/gon v0.2.6-0.20231031204852-2d4f161ccecd
Update redisc and replace EachRedisNode implementation (#1949)
2021-09-07 17:25:36 +00:00
github.com/mna/redisc v1.3.2
Add Kolide osquery tables
2023-11-02 02:11:35 +00:00
github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646
Add dev sql interceptor for logging of queries (#3815) * Add dev sql interceptor for logging of queries * Remove extra spaces and tabs from queries * Make regex global
2022-01-21 17:28:21 +00:00
github.com/ngrok/sqlmw v0.0.0-20211220175533-9d16fdc47b31
Bump github.com/nukosuke/go-zendesk from 0.12.0 to 0.13.1 (#7504) Bumps [github.com/nukosuke/go-zendesk](https://github.com/nukosuke/go-zendesk) from 0.12.0 to 0.13.1. - [Release notes](https://github.com/nukosuke/go-zendesk/releases) - [Commits](https://github.com/nukosuke/go-zendesk/compare/v0.12.0...v0.13.1) --- updated-dependencies: - dependency-name: github.com/nukosuke/go-zendesk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-13 13:49:51 +00:00
github.com/nukosuke/go-zendesk v0.13.1
Make creating dirs and files more secure by checking permissions (#1566) * Add safe mkdirall and open * Use secure as much as possible and merge gomodules for orbit to fleet * Improve openfile and mkdirall to check for permissiveness instead of equality * Don't shift * Fix links * Address review comments
2021-08-11 14:02:22 +00:00
github.com/oklog/run v1.1.0
Implement license loading and validation (#908) - Load license from ES256 signed JWT key. - Parse license claims into LicenseInfo struct. - Update contribution documentation with sample license key. Closes #816.
2021-05-31 18:35:15 +00:00
github.com/olekukonko/tablewriter v0.0.5
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/open-policy-agent/opa v1.4.2
Bump github.com/oschwald/geoip2-golang from 1.6.1 to 1.8.0 (#7767) Bumps [github.com/oschwald/geoip2-golang](https://github.com/oschwald/geoip2-golang) from 1.6.1 to 1.8.0. - [Release notes](https://github.com/oschwald/geoip2-golang/releases) - [Commits](https://github.com/oschwald/geoip2-golang/compare/v1.6.1...v1.8.0) --- updated-dependencies: - dependency-name: github.com/oschwald/geoip2-golang dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-10 21:53:19 +00:00
github.com/oschwald/geoip2-golang v1.8.0
Updated macadmins and added new tables. (#18819) #18808 Added the new `sofa_security_release_info` and `sofa_unpatched_cves` tables from `macadmins/osquery-extension` 1.0.1 These tables do not have detailed documentation in macadmins repo, so not adding documentation at this point. # Checklist for submitter <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [x] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2024-05-08 13:57:16 +00:00
github.com/osquery/osquery-go v0.0.0-20231130195733-61ac79279aaa
Use NVD API 2.0 to download CVE information (#15102) #14888 @getvictor This is ready for review, but keeping as draft as there are probably many tests that need amending. I used the new version of the `./tools/nvd/nvdvuln/nvdvuln.go` to compare the current vulnerabilities found in our dogfood environment with the vulnerabilities found by the code in this PR and both results match: ``` go run -race -tags fts5 ./tools/nvd/nvdvuln/nvdvuln.go --debug --db_dir ./local --software_from_url <dogfood URL> --software_from_api_token <API_TOKEN> --sync 2>&1 | tee out.txt [...] CVEs found and expected matched! ``` - [X] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [ ] Added/updated tests - [X] Manual QA for all new/changed functionality --------- Co-authored-by: Victor Lyuboslavsky <victor@fleetdm.com> Co-authored-by: Victor Lyuboslavsky <victor.lyuboslavsky@gmail.com>
2023-11-21 18:30:07 +00:00
github.com/pandatix/nvdapi v0.6.4
App config caching per instance (#3071) * Do caching of app config per instance instead of across all of them in redis * Add changes file * Simplify code based on review comment * Use go-cache instead of creating our own * Dont export consts * Copy app config before returning it * Fix lint * Update go sum * Update go sum
2021-11-29 15:51:57 +00:00
github.com/patrickmn/go-cache v2.1.0+incompatible
Improved error handling in host enrollment (#203) This will make it easier to debug issues with the enrollment process, such as #200.
2021-01-19 22:45:58 +00:00
github.com/pkg/errors v0.9.1
Revert "Bump github.com/open-policy-agent/opa from 0.44.0 to 0.68.0" (#25348) Reverts fleetdm/fleet#22253
2025-01-10 21:12:06 +00:00
github.com/pmezard/go-difflib v1.0.0
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/prometheus/client_golang v1.21.1
Add integration tests for setting apple BM default team (#9291)
2023-01-16 14:23:32 +00:00
github.com/quasilyte/go-ruleguard/dsl v0.3.22
Updated httpsig-go library to 1.2.0 and removed vendored version. (#32426) Fixes #32393 httpsig-go library has encorporated the changes needed to support TPM, so we are removing our local version of this library. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
2025-08-28 19:28:30 +00:00
github.com/remitly-oss/httpsig-go v1.2.0
Extract metadata from installers part 2 (#18608)
2024-04-30 15:20:53 +00:00
github.com/rs/zerolog v1.32.0
Replace home-made SAML implementation with https://github.com/crewjam/saml (#28486) For https://github.com/fleetdm/confidential/issues/9931. [Here](https://github.com/fleetdm/fleet/blob/ec3e8edbdc3f1b4220ada22c8290dbf0237ce1ba/docs/Contributing/Testing-and-local-development.md?plain=1#L339)'s how to test SAML locally with SimpleSAML. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved SSO and SAML integration with enhanced session management using secure cookies. * Added support for IdP-initiated login flows. * Introduced new tests covering SSO login flows, metadata handling, and error scenarios. * **Bug Fixes** * Enhanced validation and error handling for invalid or tampered SAML responses. * Fixed session cookie handling during SSO and Apple MDM SSO flows. * **Refactor** * Replaced custom SAML implementation with the crewjam/saml library for improved reliability. * Simplified SAML metadata parsing and session store management. * Streamlined SSO authorization request and response processing. * Removed deprecated fields and redundant code related to SSO. * **Documentation** * Updated testing and local development docs with clearer instructions for SSO and IdP-initiated login. * **Chores** * Upgraded dependencies including crewjam/saml and related packages. * Cleaned up tests and configuration by removing deprecated fields and unused imports. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-07 18:13:46 +00:00
github.com/russellhaering/goxmldsig v1.4.0
Fixed parsing Opera PE self-extracting archive. (#23751) #23540 Tested installers from Google drive: https://drive.google.com/drive/folders/1MZVwgZu5Af7JnSnKCFknRPGDXM29mOa6 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Added/updated tests - [x] Manual QA for all new/changed functionality --------- Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
2024-11-18 22:09:29 +00:00
github.com/saferwall/pe v1.5.5
Parsing package IDs
2024-09-03 20:53:35 +00:00
github.com/sassoftware/relic/v8 v8.0.1
Use go 1.24 new tool feature (#27765) Release notes: https://tip.golang.org/doc/go1.24 > Go modules can now track executable dependencies using tool directives in go.mod. This removes the need for the previous workaround of adding tools as blank imports to a file conventionally named “tools.go”. The go tool command can now run these tools in addition to tools shipped with the Go distribution. For more information see [the documentation](https://tip.golang.org/doc/modules/managing-dependencies#tools). The new -tool flag for go get causes a tool directive to be added to the current module for named packages in addition to adding require directives. I ran: ``` go get -tool github.com/fleetdm/fleet/v4/server/goose go get -tool github.com/kevinburke/go-bindata go get -tool github.com/quasilyte/go-ruleguard/dsl go rm tools.go go mod tidy ``` `make deps-go` was failing in CI because of the removal of `tools.go` (my guess is that `go get .` was a nop because there was nothing in `.` to download). So, taking the chance of removing `deps-go` because `go` will download packages during the build process. AFAICS there's no need to download everything beforehand.
2025-04-07 14:12:05 +00:00
github.com/scim2/filter-parser/v2 v2.2.0
Update `facebookincubator/nvdtools` package to fix false positive (#14798) #14543 Python's certifi package is ingested with the following version string: `2023.7.22`. The NVD dataset uses the following versioning: `2023.07.22`. This PR updates the nvdtools package. This is the fix in nvdtools that fixes this exact false positive: https://github.com/facebookincubator/nvdtools/commit/c0d18738cde5864576f073af99669edc92e87fb4 - [X] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md)~ - ~[ ] Documented any permissions changes (docs/Using Fleet/manage-access.md)~ - ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)~ - ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.~ - ~[ ] Added/updated tests~ - [X] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.~ - ~[ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-10-30 20:20:28 +00:00
github.com/scjalliance/comshim v0.0.0-20230315213746-5e51f40bd3b9
update to go1.22.3 + dependencies (#19142) For #16795, this: - Updates Go to go1.22.3 - Per https://github.com/fleetdm/fleet/issues/16795#issuecomment-2100450618, I also ran the following to update the versions requested by @getvictor ``` go get github.com/kataras/golog@v0.1.12 go get github.com/kataras/iris/v12@v12.2.11 go get github.com/sethvargo/go-password@v0.3.0 ``` **Notes** After this is merged people will need to update their Go version. I use gvm and I did it like: ``` $ gvm install go1.22.3 $ gvm use go1.22.3 --default ``` **Relevant changes** The release notes mention: > Previously, the variables declared by a “for” loop were created once > and updated by each iteration. In Go 1.22, each iteration of the loop > creates new variables, to avoid accidental sharing bugs. However, we already have a lint rule (see https://github.com/fleetdm/fleet/pull/13877) for this scenario, so it shouldn't affect us.
2024-05-23 19:23:38 +00:00
github.com/sethvargo/go-password v0.3.0
github.com/shirou/gopsutil/v3 v3.24.3
Feat 1817 add iam auth to mysql and redis (#32488) for #1817 # Details This PR gives Fleet servers the ability to connect to RDS MySQL and Elasticache Redis via AWS [Identity and Access Management (IAM)](https://aws.amazon.com/iam/). It is based almost entirely on the work of @titanous, branched from his [original pull request](https://github.com/fleetdm/fleet/pull/31075). The main differences between his branch and this are: 1. Removal of auto-detection of AWS region (and cache name for Elasticache) in favor of specifying these values in configuration. The auto-detection is admittedly handy but parsing AWS host URLs is not considered a best practice. 2. Relying on the existence of these new configs to determine whether or not to connect via IAM. This sidesteps a thorny issue of whether to try an IAM-based Elasticache connection when a password is not supplied, since this is technically a valid setup. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually - besides using @titanous's excellent test tool, I verified the following end-to-end: - [X] regular (non RDS) MySQL connection - [X] RDS MySQL connection using username/password - [X] RDS MySQL connection using IAM (no role) - [X] RDS MySQL connection using IAM (assuming role) - [X] regular (non Elasticache) Redis connection - [X] Elasticache Redis connection using username/password - [X] Elasticache Redis connection using NO password (without IAM) - [X] Elasticache Redis connection using IAM (no role) - [X] Elasticache Redis connection using IAM (assuming role) --------- Co-authored-by: Jonathan Rudenberg <jonathan@titanous.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2025-09-04 15:08:47 +00:00
github.com/shogo82148/rdsmysql/v2 v2.4.0
Linux Key Escrow - Agent (#23771)
2024-11-21 16:31:03 +00:00
github.com/siderolabs/go-blockdevice/v2 v2.0.3
Add MacAdmins tables in Orbit extension (#2140) Uses the extension tables from https://github.com/macadmins/osquery-extension. Co-authored-by: Zach Wasserman <zach@fleetdm.com>
2021-11-16 02:40:53 +00:00
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
implement OTA enrollment (#21942) for #21019 # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] Added/updated tests - [x] Manual QA for all new/changed functionality
2024-09-10 19:52:17 +00:00
github.com/smallstep/pkcs7 v0.0.0-20240723090913-5e2c6a136dfa
Updating scep package with latest fixes (#22372) Updating scep package with changes up to github.com/micromdm/scep@781f8042a79cabcf61a5e6c01affdbadcb785932 Fixes needed for NDES client for #21955 Manually pulled in the recent changes. You can view the changes in the remote like: https://github.com/getvictor/scep/compare/fleet...micromdm%3Ascep%3Amain
2024-09-27 12:04:11 +00:00
github.com/smallstep/scep v0.0.0-20240214080410-892e41795b99
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/spf13/cast v1.7.1
github.com/spf13/cobra v1.9.1
github.com/spf13/viper v1.20.1
Bump github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#25280)
2025-01-09 18:09:49 +00:00
github.com/stretchr/testify v1.10.0
Add Kolide osquery tables
2023-11-02 02:11:35 +00:00
github.com/theupdateframework/go-tuf v0.5.2
Add Redis cluster support (#1045) This should support Redis in both cluster and non-cluster modes. Updates were made separately to github.com/throttled/throttled to support the slight changes in types. Co-authored-by: Joseph Macaulay <joseph.macaulay@uber.com> Co-authored-by: Zach Wasserman <zach@fleetdm.com>
2021-06-18 15:51:47 +00:00
github.com/throttled/throttled/v2 v2.8.0
Add CentOS parsing+post-processing to reduce false positives in vulnerability processing (#4037) * Add CentOS parsing and post-processing in fleet * Add tests and amend SyncCPEDatabase * Add test for centosPostProcessing * Changes from PR comments * Amend software test * Fix sync test * Add index to source and vendor * Use os.MkdirTemp * Rearrange migrations * Regenerate test schema * Add support for testing migrations (#4112) * Add support for testing migrations * Rename migration in tests * Changes suggested in PR * Go mod tidy
2022-02-14 18:13:44 +00:00
github.com/tj/assert v0.0.3
Update github.com/ulikunitz/xz to v0.5.15 (#33221) Resolve https://github.com/fleetdm/fleet/security/code-scanning/1445.
2025-09-19 19:47:11 +00:00
github.com/ulikunitz/xz v0.5.15
[fleetctl] api command: support request body, including file uploads (#30806) Add the capability to build a request body with `fleetctl api`, including uploading files. Example command to upload a software package: ```sh fleetctl api --debug -X POST -F team_id=0 -F 'software=@./server/service/testdata/software-installers/ruby.deb' software/package ``` Unit tests are included for both simple POST requests and file uploads. Closes #21754. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality
2025-07-29 13:15:23 +00:00
github.com/urfave/cli/v2 v2.27.7
fix go mod conflicts
2024-04-30 10:42:11 +00:00
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8
Move external dependency `goose` to monorepo (#15859) #15555 Probably the best way to review this is commit by commit: - First commit does the actual moving. - Second commit fixes golangci-lint issues (in the least effort way to avoid refactoring or rearrangement of some of the code). - Third commit moves a printf to before the migration step is executed. In the past some customers hitting migration issues (like migration steps hanging or taking long to execute) and wanted to know which one was it. The only way to know was to look at the repository and looking for the next migration after the last one logged. Checks: - [X] Manual QA for all new/changed functionality Manual tests: - `make fleet && make db-reset`. - Adding a new migration via `make migration name=Foobar` and then running `./build/fleet prepare db`. - Enrolling a new device to Fleet (smoke test).
2024-01-02 20:52:00 +00:00
github.com/ziutek/mymysql v1.5.4
Adding missing instrumentation for APM. (#23882) #19696 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Manual QA for all new/changed functionality
2024-11-18 15:58:24 +00:00
go.elastic.co/apm/module/apmgorilla/v2 v2.6.2
Update `apmhttp` to fix upload of software packages in Dogfood (#27929) For #27235. This is updating the dependency after fixing the bug in https://github.com/elastic/apm-agent-go/pull/1707. The issue with the upload of medium/big sized packages can be reproduced by running `fleet serve` with `FLEET_LOGGING_TRACING_ENABLED=1 FLEET_LOGGING_TRACING_TYPE=elasticapm`. We have reproduced this issue in Dogfood only because it's the only production environment where APM tracing is enabled. We also have APM enabled in our internal load-testing to collect data during troubleshooting. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [X] Manual QA for all new/changed functionality
2025-04-08 13:28:31 +00:00
go.elastic.co/apm/module/apmhttp/v2 v2.7.1-0.20250407084155-22ab1be21948
Adding missing instrumentation for APM. (#23882) #19696 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Manual QA for all new/changed functionality
2024-11-18 15:58:24 +00:00
go.elastic.co/apm/module/apmsql/v2 v2.6.2
Update `apmhttp` to fix upload of software packages in Dogfood (#27929) For #27235. This is updating the dependency after fixing the bug in https://github.com/elastic/apm-agent-go/pull/1707. The issue with the upload of medium/big sized packages can be reproduced by running `fleet serve` with `FLEET_LOGGING_TRACING_ENABLED=1 FLEET_LOGGING_TRACING_TYPE=elasticapm`. We have reproduced this issue in Dogfood only because it's the only production environment where APM tracing is enabled. We also have APM enabled in our internal load-testing to collect data during troubleshooting. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [X] Manual QA for all new/changed functionality
2025-04-08 13:28:31 +00:00
go.elastic.co/apm/v2 v2.7.0
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
go.etcd.io/bbolt v1.3.10
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.60.0
Update github.com/ulikunitz/xz to v0.5.15 (#33221) Resolve https://github.com/fleetdm/fleet/security/code-scanning/1445.
2025-09-19 19:47:11 +00:00
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
go.opentelemetry.io/otel v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0
go.opentelemetry.io/otel/sdk v1.37.0
Updated go to 1.25.1 (#32833)
2025-09-11 23:31:39 +00:00
go.opentelemetry.io/otel/trace v1.37.0
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
golang.org/x/crypto v0.39.0
Bump github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#25280)
2025-01-09 18:09:49 +00:00
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
Bump golang.org/x/image from 0.10.0 to 0.18.0 (#20031)
2024-06-26 21:22:28 +00:00
golang.org/x/image v0.18.0
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
golang.org/x/mod v0.25.0
golang.org/x/net v0.41.0
golang.org/x/oauth2 v0.30.0
golang.org/x/sync v0.15.0
golang.org/x/sys v0.33.0
golang.org/x/term v0.32.0
golang.org/x/text v0.26.0
golang.org/x/tools v0.33.0
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
google.golang.org/api v0.215.0
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
google.golang.org/grpc v1.73.0
Bump gopkg.in/guregu/null.v3 from 3.4.0 to 3.5.0 (#7768) Bumps [gopkg.in/guregu/null.v3](https://github.com/guregu/null) from 3.4.0 to 3.5.0. - [Release notes](https://github.com/guregu/null/releases) - [Commits](https://github.com/guregu/null/compare/v3.4.0...v3.5.0) --- updated-dependencies: - dependency-name: gopkg.in/guregu/null.v3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-10 21:52:07 +00:00
gopkg.in/guregu/null.v3 v3.5.0
Update `sockjs-go` package to `v3.0.2` (#11884) In #10957, a customer attempted to run a live query on ~60k devices. We saw that Fleet receives all results from the devices, but stops sending them to the browser. We believe this _might_ be a deadlock (we couldn't confirm this because of lack of access to the Fleet instance itself). We haven't fully confirmed this to be the reason of the hang/missing-results, but it's worth updating because it [fixes a possible deadlock in the package](https://github.com/igm/sockjs-go/releases/tag/v3.0.2). The remaining changes are the result of running `go mod tidy`. - ~[ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information.~ - ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md)~ - ~[ ] Documented any permissions changes~ - ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)~ - ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.~ - ~[ ] Added/updated tests~ - [X] Manual QA for all new/changed functionality - ~For Orbit and Fleet Desktop changes:~ - ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.~ - ~[ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-05-25 11:12:24 +00:00
gopkg.in/ini.v1 v1.67.0
Upgrade osquery-go (#4728) * Upgrade and replace kolide/osquery-go with osquery/osquery-go * Upgrade macadmins/osquery-extension to v0.0.7 * Upgrade kolide/launcher to latest * go mod tidy
2022-03-23 15:15:37 +00:00
gopkg.in/natefinch/lumberjack.v2 v2.0.0
Implement license loading and validation (#908) - Load license from ES256 signed JWT key. - Parse license claims into LicenseInfo struct. - Update contribution documentation with sample license key. Closes #816.
2021-05-31 18:35:15 +00:00
gopkg.in/yaml.v2 v2.4.0
Updated go to 1.25.1 (#32833)
2025-09-11 23:31:39 +00:00
gopkg.in/yaml.v3 v3.0.1
Extract metadata from installers part 2 (#18608)
2024-04-30 15:20:53 +00:00
howett.net/plist v1.0.1
software.sslmate.com/src/go-pkcs12 v0.4.0
Migrate dependencies to go modules (#2094) These changes should be transparent to users and developers. Thanks to @davepgreene who made the first stab at this.
2019-08-13 17:32:23 +00:00
)
Implement release automation (#1215) - Use goreleaser to automate release process. - Add new dockerfiles for fleet (with fleetctl) and fleetctl (only). - Add GitHub Action Workflow to run goreleaser on new tag. - Update NPM to match new archive naming.
2021-06-26 01:40:26 +00:00
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
require (
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
cloud.google.com/go v0.116.0 // indirect
cloud.google.com/go/auth v0.13.0 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.6 // indirect
cloud.google.com/go/compute/metadata v0.6.0 // indirect
cloud.google.com/go/iam v1.2.2 // indirect
Bump github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0 (#15841) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.4.2 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.4.2...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.4.2&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-29 14:38:17 +00:00
dario.cat/mergo v1.0.0 // indirect
Update nanomdm dependency with latest bug fixes and improvements. (#23906) #23905 - Update with upstream nanomdm changes up to https://github.com/micromdm/nanomdm/tree/825f2979a2dc28c6cc57bb62aff16737978bd90e - Removed PostgeSQL folder from our nanomdm - Added nanomdm MySQL test job to our CI # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Added/updated tests - [x] Manual QA for all new/changed functionality
2024-11-20 17:47:11 +00:00
filippo.io/edwards25519 v1.1.0 // indirect
Add containerd_containers table to fleetd (#29384) # Checklist for submitter Implementation for #28315 <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added/updated automated tests (automated testing seemed infeasible) - [x] Manual QA for all new/changed functionality (tested on Ubuntu 24) - For Orbit and Fleet Desktop changes: - [x] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)). - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. (tested on Ubuntu 24, code does not compile on other platforms)
2025-05-27 17:55:38 +00:00
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/AlekSi/pointer v1.2.0 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/sprig v2.22.0+incompatible // indirect
Updated macadmins and added new tables. (#18819) #18808 Added the new `sofa_security_release_info` and `sofa_unpatched_cves` tables from `macadmins/osquery-extension` 1.0.1 These tables do not have detailed documentation in macadmins repo, so not adding documentation at this point. # Checklist for submitter <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [x] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2024-05-08 13:57:16 +00:00
github.com/Microsoft/go-winio v0.6.2 // indirect
Add containerd_containers table to fleetd (#29384) # Checklist for submitter Implementation for #28315 <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added/updated automated tests (automated testing seemed infeasible) - [x] Manual QA for all new/changed functionality (tested on Ubuntu 24) - For Orbit and Fleet Desktop changes: - [x] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)). - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. (tested on Ubuntu 24, code does not compile on other platforms)
2025-05-27 17:55:38 +00:00
github.com/Microsoft/hcsshim v0.11.7 // indirect
Bump github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#25280)
2025-01-09 18:09:49 +00:00
github.com/ProtonMail/go-crypto v1.1.3 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/agnivade/levenshtein v1.2.1 // indirect
Feature 8058: Added resource.syso metadata file (#10783) Addresses https://github.com/fleetdm/fleet/issues/8058, https://github.com/fleetdm/fleet/issues/11012 and https://github.com/fleetdm/fleet/issues/11013 This PR adds a new VERSIONINFO metadata file using the https://github.com/josephspurrier/goversioninfo library.
2023-05-17 21:53:25 +00:00
github.com/akavel/rsrc v0.10.2 // indirect
Cis 5.2.x (#9489)
2023-01-25 20:53:24 +00:00
github.com/antchfx/xpath v1.2.2 // indirect
update macadmins/osquery-extension to v0.0.15 (#13371) changelog for the version bump can be found here: https://github.com/macadmins/osquery-extension/releases/tag/v0.0.15 related to #13158 as this fixes a bug in the extension causing `profiles show --type enrollment` to be run almost every time we queried something from the `mdm` table. I couldn't find any new tables. Other than that, some dependencies were updated on their repo as well, most notably `osquery/osquery-go`
2023-08-18 15:38:49 +00:00
github.com/apache/thrift v0.18.1 // indirect
Linux Key Escrow - Agent (#23771)
2024-11-21 16:31:03 +00:00
github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/armon/go-radix v1.0.0 // indirect
Migrate from `aws-sdk-go` v1 to v2 (#30308) #29482 [Migrate to the AWS SDK for Go v2](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/migrate-gosdk.html) documents how to migrate codebases. QA on features that use AWS SDK Go: - Bootstrap package: - upload: ✅ - download: ✅ - cleanup: ✅ - Software (upload, download, installation, etc.) ✅ - Cloudfront: Luckly, this feature was already using aws-sdk-go-v2. - Carves ✅ - Logging: - Firehose ✅ - Kinesis ✅ - Lambda ✅ (tested result logs to a lambda function on our AWS Dogfood account) - Email: - Amazon SES TODO ⚠️ (this is what Dogfood uses and a few customers) - We cannot easily test locally, we can use dogfood or load testing (AWS) environments. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality
2025-06-30 20:45:39 +00:00
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 // indirect
Add support for reading private_key from AWS Secrets Manager (#31134) Adds support for reading server `private_key` from AWS Secrets Manager. Combined with #31075, this should allow removing all common sensitive secrets from the environment/config (if I missed any let me know). This works with localstack for local development (set `AWS_ENDPOINT_URL=$LOCALSTACK_URL`, `AWS_ACCESS_KEY_ID=test`, and `AWS_SECRET_ACCESS_KEY=test`). I did not include config options for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` because they are a bad practice vs role credentials and defeat the purpose of this feature which is to remove secrets from the environment/config. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality --------- Co-authored-by: Scott Gress <scott@fleetdm.com>
2025-09-09 21:56:35 +00:00
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.37 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.37 // indirect
Migrate from `aws-sdk-go` v1 to v2 (#30308) #29482 [Migrate to the AWS SDK for Go v2](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/migrate-gosdk.html) documents how to migrate codebases. QA on features that use AWS SDK Go: - Bootstrap package: - upload: ✅ - download: ✅ - cleanup: ✅ - Software (upload, download, installation, etc.) ✅ - Cloudfront: Luckly, this feature was already using aws-sdk-go-v2. - Carves ✅ - Logging: - Firehose ✅ - Kinesis ✅ - Lambda ✅ (tested result logs to a lambda function on our AWS Dogfood account) - Email: - Amazon SES TODO ⚠️ (this is what Dogfood uses and a few customers) - We cannot easily test locally, we can use dogfood or load testing (AWS) environments. --- - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Manual QA for all new/changed functionality
2025-06-30 20:45:39 +00:00
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/beorn7/perks v1.0.1 // indirect
github.com/c-bata/go-prompt v0.2.3 // indirect
Add initial Arch Linux support (#33096) For #32859. We can ignore the "Dependency review" failure in [CVE-2023-32698](https://github.com/advisories/GHSA-w7jw-q4fg-qc4c) because we already have the rules to ignore it (we are not vulnerable). I'm not updating nfpm to latest because it would require further changes on all deb/rpm generation (source code breaking changes on the golang interfaces). --- <img width="448" height="151" alt="screenshot-2025-09-11_08-38-20" src="https://github.com/user-attachments/assets/4c00b960-568a-48d9-8098-308c8ab8916f" /> <img width="391" height="73" alt="screenshot-2025-09-11_08-37-40" src="https://github.com/user-attachments/assets/dec6ea22-31f8-4930-b067-0b04b4ec2b5f" /> <img width="759" height="428" alt="Image" src="https://github.com/user-attachments/assets/0a76d070-4709-4a35-8e6e-caf869473d28" /> <img width="1178" height="634" alt="Image" src="https://github.com/user-attachments/assets/98e6fa2a-ba07-4a55-81aa-ad747f1c57b9" /> <img width="1388" height="830" alt="Image" src="https://github.com/user-attachments/assets/19d36bad-d01d-4130-b271-38bea2534833" /> <img width="933" height="930" alt="Image" src="https://github.com/user-attachments/assets/1d6a369b-65d7-46a4-98a6-e6f0b29be2c8" /> <img width="2241" height="693" alt="Image" src="https://github.com/user-attachments/assets/d8f98e97-f027-4c1c-ae5d-c4fa3b592a20" /> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [X] QA'd all new/changed functionality manually
2025-09-18 21:55:31 +00:00
github.com/cavaliergopher/cpio v1.0.1 // indirect
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
github.com/cenkalti/backoff/v5 v5.0.2 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/cespare/xxhash v1.1.0 // indirect
Updated OpenTelemetry dependencies to latest. (#23186) #23183 Updated OpenTelemetry libraries as part of research into error logging for orbit. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Manual QA for all new/changed functionality
2024-10-25 14:43:32 +00:00
github.com/cespare/xxhash/v2 v2.3.0 // indirect
Bump github.com/cloudflare/circl from 1.3.8 to 1.6.1 (#29899) Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.3.8 to 1.6.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/circl/releases">github.com/cloudflare/circl's releases</a>.</em></p> <blockquote> <h2>CIRCL v1.6.1</h2> <ul> <li>Fixes some point checks on the FourQ curve.</li> <li>Hybrid KEM fails on low-order points.</li> </ul> <h3>What's Changed</h3> <ul> <li>kem/hybrid: ensure X25519 hybrids fails with low order points by <a href="https://github.com/Lekensteyn"><code>@​Lekensteyn</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/541">cloudflare/circl#541</a></li> <li>.github: Use native ARM64 builders instead of QEMU by <a href="https://github.com/Lekensteyn"><code>@​Lekensteyn</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/542">cloudflare/circl#542</a></li> <li>Fixes several errors on twisted Edwards curves. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/545">cloudflare/circl#545</a></li> <li>Release v1.6.1 by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/546">cloudflare/circl#546</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.6.0...v1.6.1">https://github.com/cloudflare/circl/compare/v1.6.0...v1.6.1</a></p> <h2>CIRCL v1.6.0</h2> <h3>New!</h3> <ul> <li><a href="https://github.com/cloudflare/circl/blob/main/vdaf/prio3">Prio3</a> Verifiable Distributed Aggregation Function (<a href="https://datatracker.ietf.org/doc/draft-irtf-cfrg-vdaf/">draft-irtf-cfrg-vdaf</a>).</li> <li><a href="https://github.com/cloudflare/circl/blob/main/kem/xwing">X-Wing</a>: general-purpose hybrid post-quantum KEM (<a href="https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/">draft-connolly-cfrg-xwing-kem</a>)</li> </ul> <h3>What's Changed</h3> <ul> <li>Add OIDs to ML-DSA by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/519">cloudflare/circl#519</a></li> <li>Adds Prio3 a set of verifiable distributed aggregation functions. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/522">cloudflare/circl#522</a></li> <li>Run semgrep cronjob only in upstream repository. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/526">cloudflare/circl#526</a></li> <li>X-Wing PQ/T hybrid by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/471">cloudflare/circl#471</a></li> <li>ckem: move crypto/elliptic to crypto/ecdh by <a href="https://github.com/MingLLuo"><code>@​MingLLuo</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/529">cloudflare/circl#529</a></li> <li>hpke: Update HPKE code to use ecdh stdlib package. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/530">cloudflare/circl#530</a></li> <li>prio3: Adds polynomial multiplication using NTT by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/532">cloudflare/circl#532</a></li> <li>Add Prio3 in readme. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/527">cloudflare/circl#527</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/MingLLuo"><code>@​MingLLuo</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/529">cloudflare/circl#529</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.5.0...v1.6.0">https://github.com/cloudflare/circl/compare/v1.5.0...v1.6.0</a></p> <h1>CIRCL v1.5.0</h1> <p><strong>New:</strong> ML-DSA, Module-Lattice-based Digital Signature Algorithm.</p> <h3>What's Changed</h3> <ul> <li>kem: add X25519MLKEM768 TLS hybrid KEM by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/510">cloudflare/circl#510</a></li> <li>Create semgrep.yml by <a href="https://github.com/hrushikeshdeshpande"><code>@​hrushikeshdeshpande</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/514">cloudflare/circl#514</a></li> <li>repo: Some fixes reported by CodeQL by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/515">cloudflare/circl#515</a></li> <li>Add ML-DSA (FIPS204) by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/480">cloudflare/circl#480</a></li> <li>sign/mldsa: Add test for ML-DSA signature verification. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/517">cloudflare/circl#517</a></li> <li>Release v1.5.0 by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/518">cloudflare/circl#518</a></li> </ul> <h3>New Contributors</h3> <ul> <li><a href="https://github.com/hrushikeshdeshpande"><code>@​hrushikeshdeshpande</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/514">cloudflare/circl#514</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.4.0...v1.5.0">https://github.com/cloudflare/circl/compare/v1.4.0...v1.5.0</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudflare/circl/commit/c6d33e35234ebf5c4319d12ae7d77d7d17053e56"><code>c6d33e3</code></a> Release v1.6.1</li> <li><a href="https://github.com/cloudflare/circl/commit/0c3868ef6fc8ce864bc4104863186afdd2947f14"><code>0c3868e</code></a> curve4q: Shared must fail with low order points.</li> <li><a href="https://github.com/cloudflare/circl/commit/9fd570dd508eef941d3f42fb94413a899b96d52e"><code>9fd570d</code></a> curve4q: Test showing DH does not fails on identity point.</li> <li><a href="https://github.com/cloudflare/circl/commit/c988ceba827fe09896e770c152646dded447903d"><code>c988ceb</code></a> fourq: Correctly unmarshalling point.</li> <li><a href="https://github.com/cloudflare/circl/commit/ef2611dcde7f6d25e31082412bbb30f2a870d133"><code>ef2611d</code></a> fourq: Test showing point unmarshal fails.</li> <li><a href="https://github.com/cloudflare/circl/commit/05eba44d1a35f979c5f3ac914bcc50c1122e8ced"><code>05eba44</code></a> fourq: Handle the case of Z=0 for IsOnCurve and IsEqual.</li> <li><a href="https://github.com/cloudflare/circl/commit/eef08780cc3cb9befa20014e65f731391103be6b"><code>eef0878</code></a> fourq: Test showing isEqual and IsOnCurve fail.</li> <li><a href="https://github.com/cloudflare/circl/commit/2298474ef688938e4a81ca14990b9a11a8677e2a"><code>2298474</code></a> goldilocks; Handling points with z=0.</li> <li><a href="https://github.com/cloudflare/circl/commit/5a940a111507232035d0b753fbf3068c52d6b8ac"><code>5a940a1</code></a> goldilocks: Test for IsEqual must fail with Z=0</li> <li><a href="https://github.com/cloudflare/circl/commit/48c3b6a2746a18db4d8b675ab296980514359340"><code>48c3b6a</code></a> ed25519: Fix isEqual to handle points with Z=0.</li> <li>Additional commits viewable in <a href="https://github.com/cloudflare/circl/compare/v1.3.8...v1.6.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/cloudflare/circl&package-manager=go_modules&previous-version=1.3.8&new-version=1.6.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
2025-06-11 15:51:03 +00:00
github.com/cloudflare/circl v1.6.1 // indirect
Add containerd_containers table to fleetd (#29384) # Checklist for submitter Implementation for #28315 <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added/updated automated tests (automated testing seemed infeasible) - [x] Manual QA for all new/changed functionality (tested on Ubuntu 24) - For Orbit and Fleet Desktop changes: - [x] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)). - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. (tested on Ubuntu 24, code does not compile on other platforms)
2025-05-27 17:55:38 +00:00
github.com/containerd/cgroups v1.1.0 // indirect
github.com/containerd/containerd/api v1.8.0 // indirect
github.com/containerd/continuity v0.4.4 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/fifo v1.1.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/platforms v0.2.1 // indirect
github.com/containerd/ttrpc v1.2.7 // indirect
github.com/containerd/typeurl/v2 v2.1.1 // indirect
[fleetctl] api command: support request body, including file uploads (#30806) Add the capability to build a request body with `fleetctl api`, including uploading files. Example command to upload a software package: ```sh fleetctl api --debug -X POST -F team_id=0 -F 'software=@./server/service/testdata/software-installers/ruby.deb' software/package ``` Unit tests are included for both simple POST requests and file uploads. Closes #21754. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality
2025-07-29 13:15:23 +00:00
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
Bump github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#25280)
2025-01-09 18:09:49 +00:00
github.com/cyphar/filepath-securejoin v0.2.5 // indirect
Revert "Bump github.com/open-policy-agent/opa from 0.44.0 to 0.68.0" (#25348) Reverts fleetdm/fleet#22253
2025-01-10 21:12:06 +00:00
github.com/dgraph-io/ristretto v0.1.0 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da // indirect
Add SCIM Users (#27551) For #27287 Video explaining the PR: https://www.youtube.com/watch?v=ZHgFUAvrPEI This PR adds SCIM Users support for Okta. The goal is to first add Users/Groups support so that the remaining backend SCIM work can be done in parallel. This PR does not include the following, which will be added in later PRs - Changes file - Groups support for Okta - Full support for Entra ID - Integration tests # Checklist for submitter - [x] If database migrations are included, checked table schema to confirm autoupdate - For database migrations: - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality
2025-04-01 16:02:24 +00:00
github.com/di-wu/parser v0.2.2 // indirect
github.com/di-wu/xsd-datetime v1.0.0 // indirect
Bump github.com/docker/docker from 24.0.9+incompatible to 26.1.4+incompatible (#20839)
2024-07-30 18:47:21 +00:00
github.com/distribution/reference v0.6.0 // indirect
add upgrade tests (#6596) * add upgrade tests * fix lint issues go.mod * remove req.cnf * revert unrelated changes * make version configurable in test * fix golangci-lint ruleguard issue Related to https://github.com/go-critic/go-critic/issues/1152 Need to have github.com/quasilyte/go-ruleguard/dsl * fix lint issues * fix * clean up docker-compose.yml * fix http request * add readme * fix lint issues * address feedback * fix * add platform * address feedback * run go fmt
2022-07-19 21:11:51 +00:00
github.com/docker/go-connections v0.4.0 // indirect
Add containerd_containers table to fleetd (#29384) # Checklist for submitter Implementation for #28315 <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added/updated automated tests (automated testing seemed infeasible) - [x] Manual QA for all new/changed functionality (tested on Ubuntu 24) - For Orbit and Fleet Desktop changes: - [x] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)). - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. (tested on Ubuntu 24, code does not compile on other platforms)
2025-05-27 17:55:38 +00:00
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
Fleet server verifies HTTP signature (#30825) Fixes #30473 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Added/updated automated tests - [ ] Manual QA for all new/changed functionality <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for TPM-backed host identity certificates enabling hardware-backed HTTP signature authentication for hosts. * Introduced HTTP signature verification middleware for API requests, applied conditionally for premium licenses. * Hosts presenting identity certificates must authenticate with matching HTTP message signatures during enrollment and authentication. * Added SCEP-based certificate issuance for secure host identity management. * Updated enrollment endpoints to use standardized request/response contract types. * **Bug Fixes** * Enhanced authentication logic to verify consistency between host identity certificates and host records, preventing duplicate or mismatched identities. * **Chores** * Updated dependencies and test infrastructure to support HTTP signature verification and host identity certificate workflows. * Added comprehensive integration and datastore tests for host identity certificate issuance, storage, and authentication. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-16 18:08:27 +00:00
github.com/dunglas/httpsfv v1.0.2 // indirect
Add Kolide osquery tables
2023-11-02 02:11:35 +00:00
github.com/dustin/go-humanize v1.0.1 // indirect
Software installers: extract metadata from installers (part 1) (#18509)
2024-04-29 13:13:36 +00:00
github.com/edsrzf/mmap-go v1.1.0 // indirect
Friday cleanup `ld: warning: ignoring duplicate libraries: '-lproc'` (#18581) To get rid of the warning: ``` ld: warning: ignoring duplicate libraries: '-lproc' ``` See https://github.com/elastic/go-sysinfo/releases/tag/v1.11.2. ``` go mod why github.com/elastic/go-sysinfo # github.com/elastic/go-sysinfo github.com/fleetdm/fleet/v4/server/contexts/ctxerr go.elastic.co/apm/v2 github.com/elastic/go-sysinfo ``` I ran: ``` go get github.com/elastic/go-sysinfo@v1.11.2 go mod tidy ```
2024-05-28 13:31:09 +00:00
github.com/elastic/go-sysinfo v1.11.2 // indirect
APM Improvements (#11103) # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md) - [ ] Documented any permissions changes - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features. - [ ] Added/updated tests - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2023-04-24 05:13:15 +00:00
github.com/elastic/go-windows v1.0.1 // indirect
Bump github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0 (#15841) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.4.2 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.4.2...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.4.2&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-29 14:38:17 +00:00
github.com/emirpasic/gods v1.18.1 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/fatih/structs v1.1.0 // indirect
Extract metadata from installers part 2 (#18608)
2024-04-30 15:20:53 +00:00
github.com/felixge/httpsnoop v1.0.4 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/fsnotify/fsnotify v1.8.0 // indirect
tool to perform touchless MDM migrations (#18151) This started as a proof of concept that was later successfully used to perform a touchless migration. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] Manual QA for all new/changed functionality --------- Co-authored-by: Zach Wasserman <zach@fleetdm.com>
2024-10-08 12:48:06 +00:00
github.com/garyburd/go-oauth v0.0.0-20180319155456-bca2e7f09a17 // indirect
Bump github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0 (#15841) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.4.2 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.4.2...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.4.2&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-29 14:38:17 +00:00
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
Bump github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#25280)
2025-01-09 18:09:49 +00:00
github.com/go-git/go-billy/v5 v5.6.0 // indirect
Bump github.com/open-policy-agent/opa from 0.42.0 to 0.44.0 (#7652) Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.42.0 to 0.44.0. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-policy-agent/opa/compare/v0.42.0...v0.44.0) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-13 11:34:39 +00:00
github.com/go-logfmt/logfmt v0.5.1 // indirect
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
github.com/go-logr/logr v1.4.3 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/go-logr/stdr v1.2.2 // indirect
Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 (#32158) Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) from 2.3.0 to 2.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-viper/mapstructure/releases">github.com/go-viper/mapstructure/v2's releases</a>.</em></p> <blockquote> <h2>v2.4.0</h2> <h2>What's Changed</h2> <ul> <li>refactor: replace interface{} with any by <a href="https://github.com/sagikazarmark"><code>@​sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/115">go-viper/mapstructure#115</a></li> <li>build(deps): bump github/codeql-action from 3.29.0 to 3.29.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/go-viper/mapstructure/pull/114">go-viper/mapstructure#114</a></li> <li>Generic tests by <a href="https://github.com/sagikazarmark"><code>@​sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/118">go-viper/mapstructure#118</a></li> <li>Fix godoc reference link in README.md by <a href="https://github.com/peczenyj"><code>@​peczenyj</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/107">go-viper/mapstructure#107</a></li> <li>feat: add StringToTimeLocationHookFunc to convert strings to *time.Location by <a href="https://github.com/ErfanMomeniii"><code>@​ErfanMomeniii</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/117">go-viper/mapstructure#117</a></li> <li>feat: add back previous StringToSlice as a weak function by <a href="https://github.com/sagikazarmark"><code>@​sagikazarmark</code></a> in <a href="https://redirect.github.com/go-viper/mapstructure/pull/119">go-viper/mapstructure#119</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ErfanMomeniii"><code>@​ErfanMomeniii</code></a> made their first contribution in <a href="https://redirect.github.com/go-viper/mapstructure/pull/117">go-viper/mapstructure#117</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0">https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-viper/mapstructure/commit/b9794a5f0e73d425210d6614ed833067029155f5"><code>b9794a5</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/119">#119</a> from go-viper/string-to-weak-slice</li> <li><a href="https://github.com/go-viper/mapstructure/commit/17cdcb0741054e2a33938adf6bd1f2a5c0aa8f30"><code>17cdcb0</code></a> feat: add back previous StringToSlice as a weak function</li> <li><a href="https://github.com/go-viper/mapstructure/commit/3caca3614c3ab2c5b5d359c44fdcd72058887b19"><code>3caca36</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/117">#117</a> from ErfanMomeniii/main</li> <li><a href="https://github.com/go-viper/mapstructure/commit/9a861bc115f2b54ed4e494662f29c172d9ef046a"><code>9a861bc</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/107">#107</a> from peczenyj/patch-2</li> <li><a href="https://github.com/go-viper/mapstructure/commit/86ed5b59da0615fb8c3a413f401cdf0231f1234c"><code>86ed5b5</code></a> refactor: update</li> <li><a href="https://github.com/go-viper/mapstructure/commit/ace5b4e8b3dec99468ffa9498e42fb09d177b0a6"><code>ace5b4e</code></a> chore: add interface any linter</li> <li><a href="https://github.com/go-viper/mapstructure/commit/1a4f1aef38bfa8549762aaf42c7c18a5d268e76e"><code>1a4f1ae</code></a> Merge pull request <a href="https://redirect.github.com/go-viper/mapstructure/issues/118">#118</a> from go-viper/generic-tests</li> <li><a href="https://github.com/go-viper/mapstructure/commit/a2689090ed4348033c36724d866faf1f911a9f63"><code>a268909</code></a> fix: lint</li> <li><a href="https://github.com/go-viper/mapstructure/commit/17f1fd44eb7606b109c9bb017c0a1c6d3e93b5cd"><code>17f1fd4</code></a> test: add more comments</li> <li><a href="https://github.com/go-viper/mapstructure/commit/b48c8566836bf291bfee2b217d51fc36e8e61f6f"><code>b48c856</code></a> test: expand tests</li> <li>Additional commits viewable in <a href="https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-viper/mapstructure/v2&package-manager=go_modules&previous-version=2.3.0&new-version=2.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-21 16:44:40 +00:00
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/gobwas/glob v0.2.3 // indirect
add upgrade tests (#6596) * add upgrade tests * fix lint issues go.mod * remove req.cnf * revert unrelated changes * make version configurable in test * fix golangci-lint ruleguard issue Related to https://github.com/go-critic/go-critic/issues/1152 Need to have github.com/quasilyte/go-ruleguard/dsl * fix lint issues * fix * clean up docker-compose.yml * fix http request * add readme * fix lint issues * address feedback * fix * add platform * address feedback * run go fmt
2022-07-19 21:11:51 +00:00
github.com/gogo/protobuf v1.3.2 // indirect
Bump github.com/golang/glog from 1.2.2 to 1.2.4 (#25818)
2025-01-28 20:58:42 +00:00
github.com/golang/glog v1.2.4 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
Bump github.com/docker/docker from 24.0.9+incompatible to 26.1.4+incompatible (#20839)
2024-07-30 18:47:21 +00:00
github.com/golang/protobuf v1.5.4 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/golang/snappy v0.0.4 // indirect
github.com/google/go-querystring v1.1.0 // indirect
Added integration test for TPM. (#31315) For #31048 This change includes some refactoring of orbit code. No functional changes. Moved non-Linux-specific code from `securehw_linux.go` to `securehw_tpm.go` so that tests on any platform can use it. There are no server changes impacting the upcoming 4.72 release. Just tests. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced a new TPM 2.0-based secure hardware interface, enabling creation, loading, and management of ECC keys within a TPM device. * Added support for both standard and RFC 9421-compatible HTTP signatures using TPM-backed keys. * **Bug Fixes** * Improved error handling and resource management for TPM operations. * **Tests** * Added comprehensive unit tests for TPM key file loading scenarios. * Introduced integration tests using a simulated TPM device to validate end-to-end secure hardware and SCEP workflows. * **Chores** * Updated dependencies for enhanced compatibility and security. * Modernized build constraints for improved maintainability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-29 18:21:09 +00:00
github.com/google/go-tpm-tools v0.4.5 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/google/s2a-go v0.1.8 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
Add initial Arch Linux support (#33096) For #32859. We can ignore the "Dependency review" failure in [CVE-2023-32698](https://github.com/advisories/GHSA-w7jw-q4fg-qc4c) because we already have the rules to ignore it (we are not vulnerable). I'm not updating nfpm to latest because it would require further changes on all deb/rpm generation (source code breaking changes on the golang interfaces). --- <img width="448" height="151" alt="screenshot-2025-09-11_08-38-20" src="https://github.com/user-attachments/assets/4c00b960-568a-48d9-8098-308c8ab8916f" /> <img width="391" height="73" alt="screenshot-2025-09-11_08-37-40" src="https://github.com/user-attachments/assets/dec6ea22-31f8-4930-b067-0b04b4ec2b5f" /> <img width="759" height="428" alt="Image" src="https://github.com/user-attachments/assets/0a76d070-4709-4a35-8e6e-caf869473d28" /> <img width="1178" height="634" alt="Image" src="https://github.com/user-attachments/assets/98e6fa2a-ba07-4a55-81aa-ad747f1c57b9" /> <img width="1388" height="830" alt="Image" src="https://github.com/user-attachments/assets/19d36bad-d01d-4130-b271-38bea2534833" /> <img width="933" height="930" alt="Image" src="https://github.com/user-attachments/assets/1d6a369b-65d7-46a4-98a6-e6f0b29be2c8" /> <img width="2241" height="693" alt="Image" src="https://github.com/user-attachments/assets/d8f98e97-f027-4c1c-ae5d-c4fa3b592a20" /> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [X] QA'd all new/changed functionality manually
2025-09-18 21:55:31 +00:00
github.com/goreleaser/chglog v0.4.2 // indirect
github.com/goreleaser/fileglob v1.3.0 // indirect
Bump github.com/gorilla/schema from 1.2.0 to 1.4.1 (#20132)
2024-07-02 17:49:30 +00:00
github.com/gorilla/schema v1.4.1 // indirect
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/hashicorp/errwrap v1.1.0 // indirect
Bump github.com/hashicorp/go-retryablehttp from 0.6.8 to 0.7.7 (#19981) Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.6.8 to 0.7.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md">github.com/hashicorp/go-retryablehttp's changelog</a>.</em></p> <blockquote> <h2>0.7.7 (May 30, 2024)</h2> <p>BUG FIXES:</p> <ul> <li>client: avoid potentially leaking URL-embedded basic authentication credentials in logs (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/158">#158</a>)</li> </ul> <h2>0.7.6 (May 9, 2024)</h2> <p>ENHANCEMENTS:</p> <ul> <li>client: support a <code>RetryPrepare</code> function for modifying the request before retrying (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/216">#216</a>)</li> <li>client: support HTTP-date values for <code>Retry-After</code> header value (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/138">#138</a>)</li> <li>client: avoid reading entire body when the body is a <code>*bytes.Reader</code> (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/197">#197</a>)</li> </ul> <p>BUG FIXES:</p> <ul> <li>client: fix a broken check for invalid server certificate in go 1.20+ (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/210">#210</a>)</li> </ul> <h2>0.7.5 (Nov 8, 2023)</h2> <p>BUG FIXES:</p> <ul> <li>client: fixes an issue where the request body is not preserved on temporary redirects or re-established HTTP/2 connections (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/207">#207</a>)</li> </ul> <h2>0.7.4 (Jun 6, 2023)</h2> <p>BUG FIXES:</p> <ul> <li>client: fixing an issue where the Content-Type header wouldn't be sent with an empty payload when using HTTP/2 (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/194">#194</a>)</li> </ul> <h2>0.7.3 (May 15, 2023)</h2> <p>Initial release</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/1542b31176d3973a6ecbc06c05a2d0df89b59afb"><code>1542b31</code></a> v0.7.7</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/defb9f441dcf67a2a56fae733482836ea83349ac"><code>defb9f4</code></a> v0.7.7</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a"><code>a99f07b</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/158">#158</a> from dany74q/danny/redacted-url-in-logs</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/8a28c574da4098c0612fe1c7135f1f6de113d411"><code>8a28c57</code></a> Merge branch 'main' into danny/redacted-url-in-logs</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/86e852df43aa0d94150c4629d74e5116d1ff3348"><code>86e852d</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/227">#227</a> from hashicorp/dependabot/github_actions/actions/chec...</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/47fe99e6460cddc5f433aad2b54dcf32281f8a53"><code>47fe99e</code></a> Bump actions/checkout from 4.1.5 to 4.1.6</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/490fc06be0931548d3523a4245d15e9dc5d9214d"><code>490fc06</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/226">#226</a> from testwill/ioutil</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/f3e9417dbfcd0dc2b4a02a1dfdeb75f1e636b692"><code>f3e9417</code></a> chore: remove refs to deprecated io/ioutil</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/d969eaa9c97860482749df718a35b4a269361055"><code>d969eaa</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/225">#225</a> from hashicorp/manicminer-patch-2</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/2ad8ed4a1d9e632284f6937e91b2f9a1d30e8298"><code>2ad8ed4</code></a> v0.7.6</li> <li>Additional commits viewable in <a href="https://github.com/hashicorp/go-retryablehttp/compare/v0.6.8...v0.7.7">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/go-retryablehttp&package-manager=go_modules&previous-version=0.6.8&new-version=0.7.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-25 13:34:28 +00:00
github.com/hashicorp/go-hclog v1.6.3 // indirect
Updated macadmins and added new tables. (#18819) #18808 Added the new `sofa_security_release_info` and `sofa_unpatched_cves` tables from `macadmins/osquery-extension` 1.0.1 These tables do not have detailed documentation in macadmins repo, so not adding documentation at this point. # Checklist for submitter <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [x] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2024-05-08 13:57:16 +00:00
github.com/hashicorp/go-version v1.6.0 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/hashicorp/golang-lru v0.5.4 // indirect
github.com/huandu/xstrings v1.3.2 // indirect
Add initial Arch Linux support (#33096) For #32859. We can ignore the "Dependency review" failure in [CVE-2023-32698](https://github.com/advisories/GHSA-w7jw-q4fg-qc4c) because we already have the rules to ignore it (we are not vulnerable). I'm not updating nfpm to latest because it would require further changes on all deb/rpm generation (source code breaking changes on the golang interfaces). --- <img width="448" height="151" alt="screenshot-2025-09-11_08-38-20" src="https://github.com/user-attachments/assets/4c00b960-568a-48d9-8098-308c8ab8916f" /> <img width="391" height="73" alt="screenshot-2025-09-11_08-37-40" src="https://github.com/user-attachments/assets/dec6ea22-31f8-4930-b067-0b04b4ec2b5f" /> <img width="759" height="428" alt="Image" src="https://github.com/user-attachments/assets/0a76d070-4709-4a35-8e6e-caf869473d28" /> <img width="1178" height="634" alt="Image" src="https://github.com/user-attachments/assets/98e6fa2a-ba07-4a55-81aa-ad747f1c57b9" /> <img width="1388" height="830" alt="Image" src="https://github.com/user-attachments/assets/19d36bad-d01d-4130-b271-38bea2534833" /> <img width="933" height="930" alt="Image" src="https://github.com/user-attachments/assets/1d6a369b-65d7-46a4-98a6-e6f0b29be2c8" /> <img width="2241" height="693" alt="Image" src="https://github.com/user-attachments/assets/d8f98e97-f027-4c1c-ae5d-c4fa3b592a20" /> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [X] QA'd all new/changed functionality manually
2025-09-18 21:55:31 +00:00
github.com/imdario/mergo v0.3.15 // indirect
Extract metadata from installers part 2 (#18608)
2024-04-30 15:20:53 +00:00
github.com/inconshreveable/mousetrap v1.1.0 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901 // indirect
github.com/jonboulle/clockwork v0.2.2 // indirect
Use go 1.24 new tool feature (#27765) Release notes: https://tip.golang.org/doc/go1.24 > Go modules can now track executable dependencies using tool directives in go.mod. This removes the need for the previous workaround of adding tools as blank imports to a file conventionally named “tools.go”. The go tool command can now run these tools in addition to tools shipped with the Go distribution. For more information see [the documentation](https://tip.golang.org/doc/modules/managing-dependencies#tools). The new -tool flag for go get causes a tool directive to be added to the current module for named packages in addition to adding require directives. I ran: ``` go get -tool github.com/fleetdm/fleet/v4/server/goose go get -tool github.com/kevinburke/go-bindata go get -tool github.com/quasilyte/go-ruleguard/dsl go rm tools.go go mod tidy ``` `make deps-go` was failing in CI because of the removal of `tools.go` (my guess is that `go get .` was a nop because there was nothing in `.` to download). So, taking the chance of removing `deps-go` because `go` will download packages during the build process. AFAICS there's no need to download everything beforehand.
2025-04-07 14:12:05 +00:00
github.com/kevinburke/go-bindata v3.24.0+incompatible // indirect
Bump github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0 (#15841) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.4.2 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.4.2...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.4.2&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-29 14:38:17 +00:00
github.com/kevinburke/ssh_config v1.2.0 // indirect
Add initial Arch Linux support (#33096) For #32859. We can ignore the "Dependency review" failure in [CVE-2023-32698](https://github.com/advisories/GHSA-w7jw-q4fg-qc4c) because we already have the rules to ignore it (we are not vulnerable). I'm not updating nfpm to latest because it would require further changes on all deb/rpm generation (source code breaking changes on the golang interfaces). --- <img width="448" height="151" alt="screenshot-2025-09-11_08-38-20" src="https://github.com/user-attachments/assets/4c00b960-568a-48d9-8098-308c8ab8916f" /> <img width="391" height="73" alt="screenshot-2025-09-11_08-37-40" src="https://github.com/user-attachments/assets/dec6ea22-31f8-4930-b067-0b04b4ec2b5f" /> <img width="759" height="428" alt="Image" src="https://github.com/user-attachments/assets/0a76d070-4709-4a35-8e6e-caf869473d28" /> <img width="1178" height="634" alt="Image" src="https://github.com/user-attachments/assets/98e6fa2a-ba07-4a55-81aa-ad747f1c57b9" /> <img width="1388" height="830" alt="Image" src="https://github.com/user-attachments/assets/19d36bad-d01d-4130-b271-38bea2534833" /> <img width="933" height="930" alt="Image" src="https://github.com/user-attachments/assets/1d6a369b-65d7-46a4-98a6-e6f0b29be2c8" /> <img width="2241" height="693" alt="Image" src="https://github.com/user-attachments/assets/d8f98e97-f027-4c1c-ae5d-c4fa3b592a20" /> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [X] QA'd all new/changed functionality manually
2025-09-18 21:55:31 +00:00
github.com/klauspost/pgzip v1.2.6 // indirect
Move external dependency `fleetdm/kolide-kit` to monorepo (#15861) #15556 We will need to pay attention when releasing fleet (the github actions were modified to use the local file now). Should be reviewed by commits (first commit is the actual adding of the `version.go` file) - [X] Manual QA for all new/changed functionality Manually tested the following: - `Settings -> My account` on the UI and checked the `/version` endpoint response. (Or also visiting https://localhost:8080/version on a browser). - Ran `make fleetctl fleet`, `./build/fleetctl --version` and `./build/fleet version`.
2024-01-02 21:22:52 +00:00
github.com/kolide/kit v0.0.0-20221107170827-fb85e3d59eab // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
Replace home-made SAML implementation with https://github.com/crewjam/saml (#28486) For https://github.com/fleetdm/confidential/issues/9931. [Here](https://github.com/fleetdm/fleet/blob/ec3e8edbdc3f1b4220ada22c8290dbf0237ce1ba/docs/Contributing/Testing-and-local-development.md?plain=1#L339)'s how to test SAML locally with SimpleSAML. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved SSO and SAML integration with enhanced session management using secure cookies. * Added support for IdP-initiated login flows. * Introduced new tests covering SSO login flows, metadata handling, and error scenarios. * **Bug Fixes** * Enhanced validation and error handling for invalid or tampered SAML responses. * Fixed session cookie handling during SSO and Apple MDM SSO flows. * **Refactor** * Replaced custom SAML implementation with the crewjam/saml library for improved reliability. * Simplified SAML metadata parsing and session store management. * Streamlined SSO authorization request and response processing. * Removed deprecated fields and redundant code related to SSO. * **Documentation** * Updated testing and local development docs with clearer instructions for SSO and IdP-initiated login. * **Chores** * Upgraded dependencies including crewjam/saml and related packages. * Cleaned up tests and configuration by removing deprecated fields and unused imports. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-07 18:13:46 +00:00
github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
Bump github.com/getsentry/sentry-go from 0.12.0 to 0.18.0 (#9793) Bumps [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) from 0.12.0 to 0.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-go/releases">github.com/getsentry/sentry-go's releases</a>.</em></p> <blockquote> <h2>0.18.0</h2> <p>The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.18.0. This release contains initial support for <a href="https://opentelemetry.io/">OpenTelemetry</a> and various other bug fixes and improvements.</p> <p><strong>Note</strong>: This is the last release supporting Go 1.17.</p> <h3>Features</h3> <ul> <li> <p>Initial support for <a href="https://opentelemetry.io/">OpenTelemetry</a>. You can now send all your OpenTelemetry spans to Sentry.</p> <p>Install the <code>otel</code> module</p> <pre lang="bash"><code>go get github.com/getsentry/sentry-go \ github.com/getsentry/sentry-go/otel </code></pre> <p>Configure the Sentry and OpenTelemetry SDKs</p> <pre lang="go"><code>import ( &quot;go.opentelemetry.io/otel&quot; sdktrace &quot;go.opentelemetry.io/otel/sdk/trace&quot; &quot;github.com/getsentry/sentry-go&quot; &quot;github.com/getsentry/sentry-go/otel&quot; // ... ) <p>// Initlaize the Sentry SDK sentry.Init(sentry.ClientOptions{ Dsn: &quot;<strong>DSN</strong>&quot;, EnableTracing: true, TracesSampleRate: 1.0, })</p> <p>// Set up the Sentry span processor tp := sdktrace.NewTracerProvider( sdktrace.WithSpanProcessor(sentryotel.NewSentrySpanProcessor()), // ... ) otel.SetTracerProvider(tp)</p> <p>// Set up the Sentry propagator otel.SetTextMapPropagator(sentryotel.NewSentryPropagator()) </code></pre></p> <p>You can read more about using OpenTelemetry with Sentry in our <a href="https://docs.sentry.io/platforms/go/performance/instrumentation/opentelemetry/">docs</a>.</p> </li> </ul> <h3>Bug Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md">github.com/getsentry/sentry-go's changelog</a>.</em></p> <blockquote> <h2>0.18.0</h2> <p>The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.18.0. This release contains initial support for <a href="https://opentelemetry.io/">OpenTelemetry</a> and various other bug fixes and improvements.</p> <p><strong>Note</strong>: This is the last release supporting Go 1.17.</p> <h3>Features</h3> <ul> <li> <p>Initial support for <a href="https://opentelemetry.io/">OpenTelemetry</a>. You can now send all your OpenTelemetry spans to Sentry.</p> <p>Install the <code>otel</code> module</p> <pre lang="bash"><code>go get github.com/getsentry/sentry-go \ github.com/getsentry/sentry-go/otel </code></pre> <p>Configure the Sentry and OpenTelemetry SDKs</p> <pre lang="go"><code>import ( &quot;go.opentelemetry.io/otel&quot; sdktrace &quot;go.opentelemetry.io/otel/sdk/trace&quot; &quot;github.com/getsentry/sentry-go&quot; &quot;github.com/getsentry/sentry-go/otel&quot; // ... ) <p>// Initlaize the Sentry SDK sentry.Init(sentry.ClientOptions{ Dsn: &quot;<strong>DSN</strong>&quot;, EnableTracing: true, TracesSampleRate: 1.0, })</p> <p>// Set up the Sentry span processor tp := sdktrace.NewTracerProvider( sdktrace.WithSpanProcessor(sentryotel.NewSentrySpanProcessor()), // ... ) otel.SetTracerProvider(tp)</p> <p>// Set up the Sentry propagator otel.SetTextMapPropagator(sentryotel.NewSentryPropagator()) </code></pre></p> <p>You can read more about using OpenTelemetry with Sentry in our <a href="https://docs.sentry.io/platforms/go/performance/instrumentation/opentelemetry/">docs</a>.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/getsentry/sentry-go/commit/4b97c8e66159e9da864d79c502e4cbf59eb38031"><code>4b97c8e</code></a> release: 0.18.0</li> <li><a href="https://github.com/getsentry/sentry-go/commit/79724631e3ad22e2c3a167dfa13936e4e4a6d5d0"><code>7972463</code></a> fix(release): Bump root module version in submodules (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/576">#576</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/612c16704968c81c84c2479cd9d74b4373a0e62a"><code>612c167</code></a> fix(build): Tidy otel submodule (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/575">#575</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/3ec394335539ae0d0de0e87c012c5a845ce8849f"><code>3ec3943</code></a> doc: Prepare 0.18.0 (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/572">#572</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/bb6e2bdbf0d32bf4645ab8a29fed6f3183ddfee7"><code>bb6e2bd</code></a> fix(otel): Use vendored bagggage implementation in propagator (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/573">#573</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/3964ecefd0682870f9e1891cf85231db52be6c07"><code>3964ece</code></a> fix(baggage): Update baggage parsing and encoding in vendored otel package (#...</li> <li><a href="https://github.com/getsentry/sentry-go/commit/ef3a838eef937b2d67445dbe70a3fae83e4ec718"><code>ef3a838</code></a> test: Add Codecov configuration file (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/569">#569</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/de904d6e9788a7e2c165bd4ec4dec06ea43c38b5"><code>de904d6</code></a> fix(otel): Require otel 1.11.0 and higher (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/567">#567</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/d0a2aa3ebdba03d70bf5228c585cae1f2a800424"><code>d0a2aa3</code></a> fix: Create a frozen DSC when calling ToBaggage (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/566">#566</a>)</li> <li><a href="https://github.com/getsentry/sentry-go/commit/fb7618028bababd9197569610a87e59bdacb037e"><code>fb76180</code></a> release: Update .craft.yml to be ready for otel submodule release (<a href="https://github-redirect.dependabot.com/getsentry/sentry-go/issues/565">#565</a>)</li> <li>Additional commits viewable in <a href="https://github.com/getsentry/sentry-go/compare/v0.12.0...v0.18.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/getsentry/sentry-go&package-manager=go_modules&previous-version=0.12.0&new-version=0.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-28 02:24:03 +00:00
github.com/mattn/go-colorable v0.1.13 // indirect
Bump github.com/hashicorp/go-retryablehttp from 0.6.8 to 0.7.7 (#19981) Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.6.8 to 0.7.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md">github.com/hashicorp/go-retryablehttp's changelog</a>.</em></p> <blockquote> <h2>0.7.7 (May 30, 2024)</h2> <p>BUG FIXES:</p> <ul> <li>client: avoid potentially leaking URL-embedded basic authentication credentials in logs (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/158">#158</a>)</li> </ul> <h2>0.7.6 (May 9, 2024)</h2> <p>ENHANCEMENTS:</p> <ul> <li>client: support a <code>RetryPrepare</code> function for modifying the request before retrying (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/216">#216</a>)</li> <li>client: support HTTP-date values for <code>Retry-After</code> header value (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/138">#138</a>)</li> <li>client: avoid reading entire body when the body is a <code>*bytes.Reader</code> (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/197">#197</a>)</li> </ul> <p>BUG FIXES:</p> <ul> <li>client: fix a broken check for invalid server certificate in go 1.20+ (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/210">#210</a>)</li> </ul> <h2>0.7.5 (Nov 8, 2023)</h2> <p>BUG FIXES:</p> <ul> <li>client: fixes an issue where the request body is not preserved on temporary redirects or re-established HTTP/2 connections (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/207">#207</a>)</li> </ul> <h2>0.7.4 (Jun 6, 2023)</h2> <p>BUG FIXES:</p> <ul> <li>client: fixing an issue where the Content-Type header wouldn't be sent with an empty payload when using HTTP/2 (<a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/194">#194</a>)</li> </ul> <h2>0.7.3 (May 15, 2023)</h2> <p>Initial release</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/1542b31176d3973a6ecbc06c05a2d0df89b59afb"><code>1542b31</code></a> v0.7.7</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/defb9f441dcf67a2a56fae733482836ea83349ac"><code>defb9f4</code></a> v0.7.7</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/a99f07beb3c5faaa0a283617e6eb6bcf25f5049a"><code>a99f07b</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/158">#158</a> from dany74q/danny/redacted-url-in-logs</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/8a28c574da4098c0612fe1c7135f1f6de113d411"><code>8a28c57</code></a> Merge branch 'main' into danny/redacted-url-in-logs</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/86e852df43aa0d94150c4629d74e5116d1ff3348"><code>86e852d</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/227">#227</a> from hashicorp/dependabot/github_actions/actions/chec...</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/47fe99e6460cddc5f433aad2b54dcf32281f8a53"><code>47fe99e</code></a> Bump actions/checkout from 4.1.5 to 4.1.6</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/490fc06be0931548d3523a4245d15e9dc5d9214d"><code>490fc06</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/226">#226</a> from testwill/ioutil</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/f3e9417dbfcd0dc2b4a02a1dfdeb75f1e636b692"><code>f3e9417</code></a> chore: remove refs to deprecated io/ioutil</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/d969eaa9c97860482749df718a35b4a269361055"><code>d969eaa</code></a> Merge pull request <a href="https://redirect.github.com/hashicorp/go-retryablehttp/issues/225">#225</a> from hashicorp/manicminer-patch-2</li> <li><a href="https://github.com/hashicorp/go-retryablehttp/commit/2ad8ed4a1d9e632284f6937e91b2f9a1d30e8298"><code>2ad8ed4</code></a> v0.7.6</li> <li>Additional commits viewable in <a href="https://github.com/hashicorp/go-retryablehttp/compare/v0.6.8...v0.7.7">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/go-retryablehttp&package-manager=go_modules&previous-version=0.6.8&new-version=0.7.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-25 13:34:28 +00:00
github.com/mattn/go-isatty v0.0.20 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/mattn/go-runewidth v0.0.9 // indirect
github.com/mattn/go-tty v0.0.3 // indirect
github.com/mitchellh/copystructure v1.2.0 // indirect
github.com/mitchellh/reflectwalk v1.0.2 // indirect
Bump github.com/docker/docker from 24.0.9+incompatible to 26.1.4+incompatible (#20839)
2024-07-30 18:47:21 +00:00
github.com/moby/docker-image-spec v1.3.1 // indirect
Add containerd_containers table to fleetd (#29384) # Checklist for submitter Implementation for #28315 <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added/updated automated tests (automated testing seemed infeasible) - [x] Manual QA for all new/changed functionality (tested on Ubuntu 24) - For Orbit and Fleet Desktop changes: - [x] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)). - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. (tested on Ubuntu 24, code does not compile on other platforms)
2025-05-27 17:55:38 +00:00
github.com/moby/locker v1.0.1 // indirect
github.com/moby/sys/mountinfo v0.6.2 // indirect
github.com/moby/sys/sequential v0.5.0 // indirect
github.com/moby/sys/signal v0.7.0 // indirect
github.com/moby/sys/user v0.3.0 // indirect
github.com/moby/sys/userns v0.1.0 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
add upgrade tests (#6596) * add upgrade tests * fix lint issues go.mod * remove req.cnf * revert unrelated changes * make version configurable in test * fix golangci-lint ruleguard issue Related to https://github.com/go-critic/go-critic/issues/1152 Need to have github.com/quasilyte/go-ruleguard/dsl * fix lint issues * fix * clean up docker-compose.yml * fix http request * add readme * fix lint issues * address feedback * fix * add platform * address feedback * run go fmt
2022-07-19 21:11:51 +00:00
github.com/opencontainers/go-digest v1.0.0 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/opencontainers/image-spec v1.1.1 // indirect
Add containerd_containers table to fleetd (#29384) # Checklist for submitter Implementation for #28315 <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added/updated automated tests (automated testing seemed infeasible) - [x] Manual QA for all new/changed functionality (tested on Ubuntu 24) - For Orbit and Fleet Desktop changes: - [x] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)). - [x] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. (tested on Ubuntu 24, code does not compile on other platforms)
2025-05-27 17:55:38 +00:00
github.com/opencontainers/runtime-spec v1.1.0 // indirect
github.com/opencontainers/selinux v1.11.0 // indirect
Bump github.com/oschwald/geoip2-golang from 1.6.1 to 1.8.0 (#7767) Bumps [github.com/oschwald/geoip2-golang](https://github.com/oschwald/geoip2-golang) from 1.6.1 to 1.8.0. - [Release notes](https://github.com/oschwald/geoip2-golang/releases) - [Commits](https://github.com/oschwald/geoip2-golang/compare/v1.6.1...v1.8.0) --- updated-dependencies: - dependency-name: github.com/oschwald/geoip2-golang dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-10 21:53:19 +00:00
github.com/oschwald/maxminddb-golang v1.10.0 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
Bump github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0 (#15841) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.4.2 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.4.2...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.4.2&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-29 14:38:17 +00:00
github.com/pjbgf/sha1cd v0.3.0 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/pkg/term v0.0.0-20190109203006-aa71e9d9e942 // indirect
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.62.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/sagikazarmark/locafero v0.7.0 // indirect
Fixed parsing Opera PE self-extracting archive. (#23751) #23540 Tested installers from Google drive: https://drive.google.com/drive/folders/1MZVwgZu5Af7JnSnKCFknRPGDXM29mOa6 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Added/updated tests - [x] Manual QA for all new/changed functionality --------- Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
2024-11-18 22:09:29 +00:00
github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d // indirect
Add Kolide osquery tables
2023-11-02 02:11:35 +00:00
github.com/secure-systems-lab/go-securesystemslib v0.5.0 // indirect
Bump github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#25280)
2025-01-09 18:09:49 +00:00
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
Add Kolide osquery tables
2023-11-02 02:11:35 +00:00
github.com/shoenig/go-m1cpu v0.1.6 // indirect
Linux Key Escrow - Agent (#23771)
2024-11-21 16:31:03 +00:00
github.com/siderolabs/go-cmd v0.1.1 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/sirupsen/logrus v1.9.3 // indirect
Bump github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#25280)
2025-01-09 18:09:49 +00:00
github.com/skeema/knownhosts v1.3.0 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/sourcegraph/conc v0.3.0 // indirect
github.com/spf13/afero v1.12.0 // indirect
github.com/spf13/pflag v1.0.6 // indirect
Updated macadmins and added new tables. (#18819) #18808 Added the new `sofa_security_release_info` and `sofa_unpatched_cves` tables from `macadmins/osquery-extension` 1.0.1 These tables do not have detailed documentation in macadmins repo, so not adding documentation at this point. # Checklist for submitter <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [x] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [x] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2024-05-08 13:57:16 +00:00
github.com/stretchr/objx v0.5.2 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/subosito/gotenv v1.6.0 // indirect
github.com/tchap/go-patricia/v2 v2.3.2 // indirect
update to go1.22.3 + dependencies (#19142) For #16795, this: - Updates Go to go1.22.3 - Per https://github.com/fleetdm/fleet/issues/16795#issuecomment-2100450618, I also ran the following to update the versions requested by @getvictor ``` go get github.com/kataras/golog@v0.1.12 go get github.com/kataras/iris/v12@v12.2.11 go get github.com/sethvargo/go-password@v0.3.0 ``` **Notes** After this is merged people will need to update their Go version. I use gvm and I did it like: ``` $ gvm install go1.22.3 $ gvm use go1.22.3 --default ``` **Relevant changes** The release notes mention: > Previously, the variables declared by a “for” loop were created once > and updated by each iteration. In Go 1.22, each iteration of the loop > creates new variables, to avoid accidental sharing bugs. However, we already have a lint rule (see https://github.com/fleetdm/fleet/pull/13877) for this scenario, so it shouldn't affect us.
2024-05-23 19:23:38 +00:00
github.com/tklauser/go-sysconf v0.3.12 // indirect
github.com/tklauser/numcpus v0.6.1 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/trivago/tgo v1.0.7 // indirect
Bump github.com/go-git/go-git/v5 from 5.4.2 to 5.11.0 (#15841) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.4.2 to 5.11.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.11.0</h2> <h2>What's Changed</h2> <ul> <li>git: validate reference names (<a href="https://redirect.github.com/go-git/go-git/issues/929">#929</a>) by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/950">go-git/go-git#950</a></li> <li>git: stop iterating at oldest shallow when pulling. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/305">#305</a> by <a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li>plumbing: object, enable renames in getFileStatsFromFilePatches by <a href="https://github.com/djmoch"><code>@​djmoch</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> <li>storage: filesystem, Add option to set a specific FS for alternates by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/953">go-git/go-git#953</a></li> <li>Align worktree validation with upstream and remove build warnings by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/958">go-git/go-git#958</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dhoizner"><code>@​dhoizner</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/939">go-git/go-git#939</a></li> <li><a href="https://github.com/djmoch"><code>@​djmoch</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/941">go-git/go-git#941</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0">https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0</a></p> <h2>v5.10.1</h2> <h2>What's Changed</h2> <ul> <li>Worktree, ignore ModeSocket files by <a href="https://github.com/steiler"><code>@​steiler</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> <li>git: add tracer package by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/916">go-git/go-git#916</a></li> <li>remote: Flip clause for fast-forward only check by <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/875">go-git/go-git#875</a></li> <li>plumbing: transport/ssh, Fix nil pointer dereference caused when an unreachable proxy server is set. Fixes <a href="https://redirect.github.com/go-git/go-git/issues/900">#900</a> by <a href="https://github.com/anandf"><code>@​anandf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li>plumbing: uppload-server-info, implement upload-server-info by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/896">go-git/go-git#896</a></li> <li>plumbing: optimise memory consumption for filesystem storage by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/799">go-git/go-git#799</a></li> <li>plumbing: format/packfile, Refactor patch delta by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/908">go-git/go-git#908</a></li> <li>plumbing: fix empty uploadpack request error by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/932">go-git/go-git#932</a></li> <li>plumbing: transport/git, Improve tests error message by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/752">go-git/go-git#752</a></li> <li>plumbing: format/pktline, Respect pktline error-line errors by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/936">go-git/go-git#936</a></li> <li>utils: remove ioutil.Pipe and use std library io.Pipe by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/922">go-git/go-git#922</a></li> <li>utils: move trace to utils by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/931">go-git/go-git#931</a></li> <li>cli: separate go module for cli by <a href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/914">go-git/go-git#914</a></li> <li>build: bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/887">go-git/go-git#887</a></li> <li>build: bump actions/setup-go from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/891">go-git/go-git#891</a></li> <li>build: bump github.com/skeema/knownhosts from 1.2.0 to 1.2.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/888">go-git/go-git#888</a></li> <li>build: bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/890">go-git/go-git#890</a></li> <li>build: bump golang.org/x/sys from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/907">go-git/go-git#907</a></li> <li>build: bump golang.org/x/text from 0.13.0 to 0.14.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/906">go-git/go-git#906</a></li> <li>build: bump golang.org/x/crypto from 0.14.0 to 0.15.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/917">go-git/go-git#917</a></li> <li>build: bump golang.org/x/net from 0.17.0 to 0.18.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/918">go-git/go-git#918</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/anandf"><code>@​anandf</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/901">go-git/go-git#901</a></li> <li><a href="https://github.com/steiler"><code>@​steiler</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-git/pull/930">go-git/go-git#930</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1">https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1</a></p> <h2>v5.10.0</h2> <h2>What's Changed</h2> <ul> <li>PlainInitOptions.Bare and allow using InitOptions with PlainInitWithOptions by <a href="https://github.com/ThinkChaos"><code>@​ThinkChaos</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/782">go-git/go-git#782</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca"><code>5d08d3b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/958">#958</a> from pjbgf/workval</li> <li><a href="https://github.com/go-git/go-git/commit/5bd1d8f4abcfbf1345a1e5a5ec9a96121f3746dc"><code>5bd1d8f</code></a> build: Ensure checkout is the first operation</li> <li><a href="https://github.com/go-git/go-git/commit/b2c19824771bbcbb21abb51abb319c1a610aa6b3"><code>b2c1982</code></a> git: worktree, Align validation with upstream rules</li> <li><a href="https://github.com/go-git/go-git/commit/cec7da63ca0412fce55a0bf0715b7ba44a41eaa2"><code>cec7da6</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/953">#953</a> from pjbgf/alternates</li> <li><a href="https://github.com/go-git/go-git/commit/8b47ceb1aa854f3c3bfa1c347157a04324fcd51e"><code>8b47ceb</code></a> storage: filesystem, Add option to set a specific FS for alternates</li> <li><a href="https://github.com/go-git/go-git/commit/4f614891047bae5d0f7a253f014175505b9821d7"><code>4f61489</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/941">#941</a> from djmoch/filestats-rename</li> <li><a href="https://github.com/go-git/go-git/commit/ae552ce0bf32cddb689727c4c9fa6bf4d3bd6499"><code>ae552ce</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/939">#939</a> from dhoizner/fix-pull-after-shallow</li> <li><a href="https://github.com/go-git/go-git/commit/cc1895b905ebadb09504d88444ff05932fa6e928"><code>cc1895b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/950">#950</a> from aymanbagabas/validate-ref</li> <li><a href="https://github.com/go-git/go-git/commit/de1d5a5978b9599ca3dacd58bbf699e4bb4cf6bd"><code>de1d5a5</code></a> git: validate reference names</li> <li><a href="https://github.com/go-git/go-git/commit/d87110b492c94d99ebdaea732b23a54b7efba94b"><code>d87110b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/948">#948</a> from go-git/dependabot/go_modules/cli/go-git/github.c...</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.4.2...v5.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.4.2&new-version=5.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/fleetdm/fleet/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-29 14:38:17 +00:00
github.com/xanzy/ssh-agent v0.3.3 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
[fleetctl] api command: support request body, including file uploads (#30806) Add the capability to build a request body with `fleetctl api`, including uploading files. Example command to upload a software package: ```sh fleetctl api --debug -X POST -F team_id=0 -F 'software=@./server/service/testdata/software-installers/ruby.deb' software/package ``` Unit tests are included for both simple POST requests and file uploads. Closes #21754. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Added/updated automated tests - [x] Manual QA for all new/changed functionality
2025-07-29 13:15:23 +00:00
github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
github.com/yashtewari/glob-intersection v0.2.0 // indirect
update to go1.22.3 + dependencies (#19142) For #16795, this: - Updates Go to go1.22.3 - Per https://github.com/fleetdm/fleet/issues/16795#issuecomment-2100450618, I also ran the following to update the versions requested by @getvictor ``` go get github.com/kataras/golog@v0.1.12 go get github.com/kataras/iris/v12@v12.2.11 go get github.com/sethvargo/go-password@v0.3.0 ``` **Notes** After this is merged people will need to update their Go version. I use gvm and I did it like: ``` $ gvm install go1.22.3 $ gvm use go1.22.3 --default ``` **Relevant changes** The release notes mention: > Previously, the variables declared by a “for” loop were created once > and updated by each iteration. In Go 1.22, each iteration of the loop > creates new variables, to avoid accidental sharing bugs. However, we already have a lint rule (see https://github.com/fleetdm/fleet/pull/13877) for this scenario, so it shouldn't affect us.
2024-05-23 19:23:38 +00:00
github.com/yusufpapurcu/wmi v1.2.4 // indirect
Add initial Arch Linux support (#33096) For #32859. We can ignore the "Dependency review" failure in [CVE-2023-32698](https://github.com/advisories/GHSA-w7jw-q4fg-qc4c) because we already have the rules to ignore it (we are not vulnerable). I'm not updating nfpm to latest because it would require further changes on all deb/rpm generation (source code breaking changes on the golang interfaces). --- <img width="448" height="151" alt="screenshot-2025-09-11_08-38-20" src="https://github.com/user-attachments/assets/4c00b960-568a-48d9-8098-308c8ab8916f" /> <img width="391" height="73" alt="screenshot-2025-09-11_08-37-40" src="https://github.com/user-attachments/assets/dec6ea22-31f8-4930-b067-0b04b4ec2b5f" /> <img width="759" height="428" alt="Image" src="https://github.com/user-attachments/assets/0a76d070-4709-4a35-8e6e-caf869473d28" /> <img width="1178" height="634" alt="Image" src="https://github.com/user-attachments/assets/98e6fa2a-ba07-4a55-81aa-ad747f1c57b9" /> <img width="1388" height="830" alt="Image" src="https://github.com/user-attachments/assets/19d36bad-d01d-4130-b271-38bea2534833" /> <img width="933" height="930" alt="Image" src="https://github.com/user-attachments/assets/1d6a369b-65d7-46a4-98a6-e6f0b29be2c8" /> <img width="2241" height="693" alt="Image" src="https://github.com/user-attachments/assets/d8f98e97-f027-4c1c-ae5d-c4fa3b592a20" /> - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [X] QA'd all new/changed functionality manually
2025-09-18 21:55:31 +00:00
gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
go.elastic.co/fastjson v1.1.0 // indirect
Replace deprecated pkcs7 package with a maintained fork (#24313)
2024-12-03 16:01:22 +00:00
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
Upgtade opentelemetry dependancies (#10950) ``` go get -u go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux go.opentelemetry.io/otel go.opentelemetry.io/otel/exporters/otlp/otlptrace go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc go.opentelemetry.io/otel/sdk; go mod tidy ``` # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md) - [ ] Documented any permissions changes - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features. - [ ] Added/updated tests - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2023-04-21 18:19:47 +00:00
go.opencensus.io v0.24.0 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
go.opentelemetry.io/otel/metric v1.37.0 // indirect
go.opentelemetry.io/proto/otlp v1.7.0 // indirect
Added integration test for TPM. (#31315) For #31048 This change includes some refactoring of orbit code. No functional changes. Moved non-Linux-specific code from `securehw_linux.go` to `securehw_tpm.go` so that tests on any platform can use it. There are no server changes impacting the upcoming 4.72 release. Just tests. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced a new TPM 2.0-based secure hardware interface, enabling creation, loading, and management of ECC keys within a TPM device. * Added support for both standard and RFC 9421-compatible HTTP signatures using TPM-backed keys. * **Bug Fixes** * Improved error handling and resource management for TPM operations. * **Tests** * Added comprehensive unit tests for TPM key file loading scenarios. * Introduced integration tests using a simulated TPM device to validate end-to-end secure hardware and SCEP workflows. * **Chores** * Updated dependencies for enhanced compatibility and security. * Modernized build constraints for improved maintainability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2025-07-29 18:21:09 +00:00
go.uber.org/multierr v1.11.0 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
golang.org/x/time v0.11.0 // indirect
Bump github.com/docker/docker from 24.0.9+incompatible to 26.1.4+incompatible (#20839)
2024-07-30 18:47:21 +00:00
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
Updated OpenTelemetry packages to latest. (#32314) Fixes #32313 Updated packages before identifying issues with our integration.
2025-08-26 16:08:49 +00:00
google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
google.golang.org/protobuf v1.36.6 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
gopkg.in/warnings.v0 v0.1.2 // indirect
Update OPA dependency to v1.4.2 (#29454) # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Added/updated automated tests - [X] Manual QA for all new/changed functionality ## Details This PR updates the Open Policy Agent (github.com/open-policy-agent/opa) to version 1.4.2, and does the necessary test updates to handle the indirect upgrade of Viper (which no longer supports YAML 1.1). Once this is done we can also [upgrade NFPM](https://github.com/fleetdm/fleet). I chose not to do that in this PR to keep it to one change at a time.
2025-05-27 16:48:38 +00:00
sigs.k8s.io/yaml v1.4.0 // indirect
bump go version in go.mod to 1.17 (#6129)
2022-06-07 19:05:55 +00:00
)
Use go 1.24 new tool feature (#27765) Release notes: https://tip.golang.org/doc/go1.24 > Go modules can now track executable dependencies using tool directives in go.mod. This removes the need for the previous workaround of adding tools as blank imports to a file conventionally named “tools.go”. The go tool command can now run these tools in addition to tools shipped with the Go distribution. For more information see [the documentation](https://tip.golang.org/doc/modules/managing-dependencies#tools). The new -tool flag for go get causes a tool directive to be added to the current module for named packages in addition to adding require directives. I ran: ``` go get -tool github.com/fleetdm/fleet/v4/server/goose go get -tool github.com/kevinburke/go-bindata go get -tool github.com/quasilyte/go-ruleguard/dsl go rm tools.go go mod tidy ``` `make deps-go` was failing in CI because of the removal of `tools.go` (my guess is that `go get .` was a nop because there was nothing in `.` to download). So, taking the chance of removing `deps-go` because `go` will download packages during the build process. AFAICS there's no need to download everything beforehand.
2025-04-07 14:12:05 +00:00
tool (
github.com/fleetdm/fleet/v4/server/goose
github.com/kevinburke/go-bindata
github.com/quasilyte/go-ruleguard/dsl
)
Reference in a new issue Copy permalink