Bump github.com/hashicorp/vault/api from 1.5.0 to 1.7.1 #79

Closed
dependabot[bot] wants to merge 1 commits from dependabot/go_modules/github.com/hashicorp/vault/api-1.7.1 into v3
dependabot[bot] commented 2022-06-09 11:18:00 +03:00 (Migrated from github.com)

Bumps github.com/hashicorp/vault/api from 1.5.0 to 1.7.1.

Release notes

Sourced from github.com/hashicorp/vault/api's releases.

v1.7.1

Release vault 1.7.1

v1.7.0

1.7.0

24 March 2021

CHANGES:

  • go: Update go version to 1.15.8 [GH-11060]

FEATURES:

  • Aerospike Storage Backend: Add support for using Aerospike as a storage backend [GH-10131]
  • agent: Support for persisting the agent cache to disk [GH-10938]
  • auth/jwt: Adds max_age role parameter and auth_time claim validation. [GH-10919]
  • kmip (enterprise): Use entropy augmentation to generate kmip certificates
  • sdk: Private key generation in the certutil package now allows custom io.Readers to be used. [GH-10653]
  • secrets/aws: add IAM tagging support for iam_user roles [GH-10953]
  • secrets/database/cassandra: Add ability to customize dynamic usernames [GH-10906]
  • secrets/database/couchbase: Add ability to customize dynamic usernames [GH-10995]
  • secrets/database/mongodb: Add ability to customize dynamic usernames [GH-10858]
  • secrets/database/mssql: Add ability to customize dynamic usernames [GH-10767]
  • secrets/database/mysql: Add ability to customize dynamic usernames [GH-10834]
  • secrets/database/postgresql: Add ability to customize dynamic usernames [GH-10766]
  • secrets/openldap: Added dynamic roles to OpenLDAP similar to the combined database engine [GH-10996]
  • secrets/terraform: New secret engine for managing Terraform Cloud API tokens [GH-10931]
  • ui: Adds check for feature flag on application, and updates namespace toolbar on login if present [GH-10588]
  • ui: Adds the wizard to the Database Secret Engine [GH-10982]
  • ui: Database secrets engine, supporting MongoDB only [GH-10655]

IMPROVEMENTS:

  • agent: Add template-retry stanza to agent config. [GH-10644]
  • agent: Agent can now run as a Windows service. [GH-10231]
  • agent: Better concurrent request handling on identical requests proxied through Agent. [GH-10705]
  • agent: Route templating server through cache when persistent cache is enabled. [GH-10927]
  • agent: change auto-auth to preload an existing token on start [GH-10850]
  • auth/ldap: Improve consistency in error messages [GH-10537]
  • auth/okta: Adds support for Okta Verify TOTP MFA. [GH-10942]
  • changelog: Add dependencies listed in dependencies/2-25-21 [GH-11015]
  • command/debug: Now collects logs (at level trace) as a periodic output. [GH-10609]
  • core (enterprise): "vault status" command works when a namespace is set. [GH-10725]
  • core (enterprise): Update Trial Enterprise license from 30 minutes to 6 hours
  • core/metrics: Added "vault operator usage" command. [GH-10365]
  • core/metrics: New telemetry metrics reporting lease expirations by time interval and namespace [GH-10375]
  • core: Added active since timestamp to the status output of active nodes. [GH-10489]
  • core: Check audit device with a test message before adding it. [GH-10520]
  • core: Track barrier encryption count and automatically rotate after a large number of operations or on a schedule [GH-10744]
  • core: add metrics for active entity count [GH-10514]

... (truncated)

Changelog

Sourced from github.com/hashicorp/vault/api's changelog.

1.7.10

March 3, 2022

BUG FIXES:

  • database/mssql: Removed string interpolation on internal queries and replaced them with inline queries using named parameters. [GH-13799]
  • ui: Fix issue removing raft storage peer via cli not reflected in UI until refresh [GH-13098]
  • ui: Trigger background token self-renewal if inactive and half of TTL has passed [GH-13950]

1.7.9

January 27, 2022

IMPROVEMENTS:

  • core: Fixes code scanning alerts [GH-13667]

BUG FIXES:

  • auth/oidc: Fixes OIDC auth from the Vault UI when using the implicit flow and form_post response mode. [GH-13493]
  • secrets/gcp: Fixes role bindings for BigQuery dataset resources. [GH-13735]
  • ui: Fixes breadcrumb bug for secrets navigation [GH-13604]
  • ui: Fixes issue saving KMIP role correctly [GH-13585]

1.7.8

December 21, 2021

CHANGES:

  • go: Update go version to 1.16.12 [GH-13422]

BUG FIXES:

  • auth/aws: Fixes ec2 login no longer supporting DSA signature verification [GH-12340]
  • identity: Fix a panic on arm64 platform when doing identity I/O. [GH-12371]

1.7.7

December 9, 2021

SECURITY:

  • storage/raft: Integrated Storage backend could be caused to crash by an authenticated user with write permissions to the KV secrets engine. This vulnerability, CVE-2021-45042, was fixed in Vault 1.7.7, 1.8.6, and 1.9.1.

BUG FIXES:

  • ha (enterprise): Prevents performance standby nodes from serving and caching stale data immediately after performance standby election completes
  • storage/raft: Fix a panic when trying to store a key > 32KB in a transaction. [GH-13286]
  • storage/raft: Fix a panic when trying to write a key > 32KB [GH-13282]
  • ui: Fixes issue restoring raft storage snapshot [GH-13107]
  • ui: Fixes issue with OIDC auth workflow when using MetaMask Chrome extension [GH-13133]
  • ui: Fixes issue with the number of PGP Key inputs not matching the key shares number in the initialization form on change [GH-13038]

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps [github.com/hashicorp/vault/api](https://github.com/hashicorp/vault) from 1.5.0 to 1.7.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/vault/releases">github.com/hashicorp/vault/api's releases</a>.</em></p> <blockquote> <h2>v1.7.1</h2> <p>Release vault 1.7.1</p> <h2>v1.7.0</h2> <h2>1.7.0</h2> <h3>24 March 2021</h3> <p>CHANGES:</p> <ul> <li>go: Update go version to 1.15.8 [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/11060">GH-11060</a>]</li> </ul> <p>FEATURES:</p> <ul> <li><strong>Aerospike Storage Backend</strong>: Add support for using Aerospike as a storage backend [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10131">GH-10131</a>]</li> <li>agent: Support for persisting the agent cache to disk [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10938">GH-10938</a>]</li> <li>auth/jwt: Adds <code>max_age</code> role parameter and <code>auth_time</code> claim validation. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10919">GH-10919</a>]</li> <li>kmip (enterprise): Use entropy augmentation to generate kmip certificates</li> <li>sdk: Private key generation in the certutil package now allows custom io.Readers to be used. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10653">GH-10653</a>]</li> <li>secrets/aws: add IAM tagging support for iam_user roles [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10953">GH-10953</a>]</li> <li>secrets/database/cassandra: Add ability to customize dynamic usernames [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10906">GH-10906</a>]</li> <li>secrets/database/couchbase: Add ability to customize dynamic usernames [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10995">GH-10995</a>]</li> <li>secrets/database/mongodb: Add ability to customize dynamic usernames [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10858">GH-10858</a>]</li> <li>secrets/database/mssql: Add ability to customize dynamic usernames [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10767">GH-10767</a>]</li> <li>secrets/database/mysql: Add ability to customize dynamic usernames [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10834">GH-10834</a>]</li> <li>secrets/database/postgresql: Add ability to customize dynamic usernames [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10766">GH-10766</a>]</li> <li>secrets/openldap: Added dynamic roles to OpenLDAP similar to the combined database engine [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10996">GH-10996</a>]</li> <li>secrets/terraform: New secret engine for managing Terraform Cloud API tokens [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10931">GH-10931</a>]</li> <li>ui: Adds check for feature flag on application, and updates namespace toolbar on login if present [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10588">GH-10588</a>]</li> <li>ui: Adds the wizard to the Database Secret Engine [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10982">GH-10982</a>]</li> <li>ui: Database secrets engine, supporting MongoDB only [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10655">GH-10655</a>]</li> </ul> <p>IMPROVEMENTS:</p> <ul> <li>agent: Add template-retry stanza to agent config. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10644">GH-10644</a>]</li> <li>agent: Agent can now run as a Windows service. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10231">GH-10231</a>]</li> <li>agent: Better concurrent request handling on identical requests proxied through Agent. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10705">GH-10705</a>]</li> <li>agent: Route templating server through cache when persistent cache is enabled. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10927">GH-10927</a>]</li> <li>agent: change auto-auth to preload an existing token on start [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10850">GH-10850</a>]</li> <li>auth/ldap: Improve consistency in error messages [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10537">GH-10537</a>]</li> <li>auth/okta: Adds support for Okta Verify TOTP MFA. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10942">GH-10942</a>]</li> <li>changelog: Add dependencies listed in dependencies/2-25-21 [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/11015">GH-11015</a>]</li> <li>command/debug: Now collects logs (at level <code>trace</code>) as a periodic output. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10609">GH-10609</a>]</li> <li>core (enterprise): &quot;vault status&quot; command works when a namespace is set. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10725">GH-10725</a>]</li> <li>core (enterprise): Update Trial Enterprise license from 30 minutes to 6 hours</li> <li>core/metrics: Added &quot;vault operator usage&quot; command. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10365">GH-10365</a>]</li> <li>core/metrics: New telemetry metrics reporting lease expirations by time interval and namespace [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10375">GH-10375</a>]</li> <li>core: Added active since timestamp to the status output of active nodes. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10489">GH-10489</a>]</li> <li>core: Check audit device with a test message before adding it. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10520">GH-10520</a>]</li> <li>core: Track barrier encryption count and automatically rotate after a large number of operations or on a schedule [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10744">GH-10744</a>]</li> <li>core: add metrics for active entity count [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/10514">GH-10514</a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hashicorp/vault/blob/main/CHANGELOG.md">github.com/hashicorp/vault/api's changelog</a>.</em></p> <blockquote> <h2>1.7.10</h2> <h3>March 3, 2022</h3> <p>BUG FIXES:</p> <ul> <li>database/mssql: Removed string interpolation on internal queries and replaced them with inline queries using named parameters. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13799">GH-13799</a>]</li> <li>ui: Fix issue removing raft storage peer via cli not reflected in UI until refresh [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13098">GH-13098</a>]</li> <li>ui: Trigger background token self-renewal if inactive and half of TTL has passed [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13950">GH-13950</a>]</li> </ul> <h2>1.7.9</h2> <h3>January 27, 2022</h3> <p>IMPROVEMENTS:</p> <ul> <li>core: Fixes code scanning alerts [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13667">GH-13667</a>]</li> </ul> <p>BUG FIXES:</p> <ul> <li>auth/oidc: Fixes OIDC auth from the Vault UI when using the implicit flow and <code>form_post</code> response mode. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13493">GH-13493</a>]</li> <li>secrets/gcp: Fixes role bindings for BigQuery dataset resources. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13735">GH-13735</a>]</li> <li>ui: Fixes breadcrumb bug for secrets navigation [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13604">GH-13604</a>]</li> <li>ui: Fixes issue saving KMIP role correctly [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13585">GH-13585</a>]</li> </ul> <h2>1.7.8</h2> <h3>December 21, 2021</h3> <p>CHANGES:</p> <ul> <li>go: Update go version to 1.16.12 [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13422">GH-13422</a>]</li> </ul> <p>BUG FIXES:</p> <ul> <li>auth/aws: Fixes ec2 login no longer supporting DSA signature verification [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/12340">GH-12340</a>]</li> <li>identity: Fix a panic on arm64 platform when doing identity I/O. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/12371">GH-12371</a>]</li> </ul> <h2>1.7.7</h2> <h3>December 9, 2021</h3> <p>SECURITY:</p> <ul> <li>storage/raft: Integrated Storage backend could be caused to crash by an authenticated user with write permissions to the KV secrets engine. This vulnerability, CVE-2021-45042, was fixed in Vault 1.7.7, 1.8.6, and 1.9.1.</li> </ul> <p>BUG FIXES:</p> <ul> <li>ha (enterprise): Prevents performance standby nodes from serving and caching stale data immediately after performance standby election completes</li> <li>storage/raft: Fix a panic when trying to store a key &gt; 32KB in a transaction. [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13286">GH-13286</a>]</li> <li>storage/raft: Fix a panic when trying to write a key &gt; 32KB [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13282">GH-13282</a>]</li> <li>ui: Fixes issue restoring raft storage snapshot [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13107">GH-13107</a>]</li> <li>ui: Fixes issue with OIDC auth workflow when using MetaMask Chrome extension [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13133">GH-13133</a>]</li> <li>ui: Fixes issue with the number of PGP Key inputs not matching the key shares number in the initialization form on change [<a href="https://github-redirect.dependabot.com/hashicorp/vault/pull/13038">GH-13038</a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hashicorp/vault/commit/917142287996a005cb1ed9d96d00d06a0590e44e"><code>9171422</code></a> core/token: fix panic looking up invalid batch tokens (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11415">#11415</a>) (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11417">#11417</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/6977c11b7117d07dd661e5727464270a0e86bce4"><code>6977c11</code></a> stage: update GO_VERSION_MIN and sdk dep (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11414">#11414</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/b296e151b5b3b97589d90dc49df6dff3b7e3cfde"><code>b296e15</code></a> Make cubbyhole revocation/tidying compatible with cubbys in namespaces. (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/114">#114</a>...</li> <li><a href="https://github.com/hashicorp/vault/commit/8f371c327df54d5a0e9b7ece383c6dd190513fcc"><code>8f371c3</code></a> Backport 1.7.1: Add root rotation statements support to database secret engin...</li> <li><a href="https://github.com/hashicorp/vault/commit/073991736c3c3a46d2e3177058b22fd23865b7e2"><code>0739917</code></a> Add support for unauthenticated pprof access on a per-listener basis,… (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/1132">#1132</a>...</li> <li><a href="https://github.com/hashicorp/vault/commit/224e04e646d55e24a621c3c792249048cc41d2ee"><code>224e04e</code></a> Cassandra DB plugin: Allow special chars in usernames (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11262">#11262</a>) (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11385">#11385</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/9c9675fd201df1780432f52bbf7dacfe1daf4dce"><code>9c9675f</code></a> Backport (1.7.x): Validate hostnames when using TLS in Cassandra <a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11365">#11365</a> (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11390">#11390</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/af3f8c421010c88f7aaf3cf2c5e458853237c71e"><code>af3f8c4</code></a> Update to Go 1.15.11 (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11395">#11395</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/3144d8f14b749fac57f0970636b35c68fd673843"><code>3144d8f</code></a> pki: fix tidy removal on revoked entries (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11367">#11367</a>) (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11400">#11400</a>)</li> <li><a href="https://github.com/hashicorp/vault/commit/7f6a5e386f9b8931991f81f8fec1b491372ec833"><code>7f6a5e3</code></a> Updates the JWT/OIDC auth plugin to v0.9.3 (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11388">#11388</a>) (<a href="https://github-redirect.dependabot.com/hashicorp/vault/issues/11399">#11399</a>)</li> <li>Additional commits viewable in <a href="https://github.com/hashicorp/vault/compare/v1.5.0...v1.7.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/hashicorp/vault/api&package-manager=go_modules&previous-version=1.5.0&new-version=1.7.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
github-actions[bot] (Migrated from github.com) approved these changes 2022-06-09 11:21:14 +03:00
dependabot[bot] commented 2022-06-10 11:22:14 +03:00 (Migrated from github.com)

Superseded by #80.

Superseded by #80.

Pull request closed

Sign in to join this conversation.
No description provided.