Bump the go_modules group across 1 directory with 11 updates

[dependabot]

Bumps the go_modules group with 5 updates in the / directory:

Package	From	To
github.com/docker/docker	20.10.24+incompatible	25.0.13+incompatible
github.com/jackc/pgx/v4	4.18.1	4.18.2
github.com/jackc/pgx/v5	5.3.1	5.5.2
github.com/dvsekhvalnov/jose2go	1.5.0	1.7.0
github.com/golang-jwt/jwt/v4	4.4.2	4.5.2

Updates github.com/docker/docker from 20.10.24+incompatible to 25.0.13+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v25.0.13

25.0.13

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

• moby/moby, 25.0.13 milestone
• Changes to the Engine API, see API version history.

Bug fixes and enhancements

• Prevent restoration of iptables rules for deleted networks and containers on firewalld reload. moby/moby#50445
• Fix Swarm services becoming unreachable from published ports after a firewalld reload. moby/moby#50445
• Improve the reliability of the Swarm overlay network control plane by fixing longstanding issues with NetworkDB. moby/moby#50511
• Improve the reliability of Swarm overlay container networks by fixing longstanding issues with the overlay network driver. moby/moby#50551

v25.0.12

25.0.12

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

• moby/moby, 25.0.12 milestone
• Changes to the Engine API, see API version history.

Bug fixes and enhancements

• Fix an issue where all new tasks in the Swarm could get stuck in the PENDING state forever after scaling up a service with placement preferences. moby/moby#50203
• Fix an issue which made DNS service discovery for Swarm services unreliable. moby/moby#50230

Packaging updates

• Update Go toolchain to go1.23.9. moby/moby#50053

v25.0.11

25.0.11

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

• moby/moby, 25.0.11 milestone
• Changes to the Engine API, see API version history.

Networking

• [25.0] Backport network fixes by @​dperny in moby/moby#50005

Known Issues

• Some Swarm services are not discoverable over DNS moby/moby#50129

Full Changelog: moby/moby@v25.0.10...v25.0.11

v25.0.10

25.0.10

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

... (truncated)

Commits

• 165516e Merge pull request #50551 from corhere/backport-25.0/libn/all-the-overlay-fixes
• f099e91 libnetwork: handle coalesced endpoint events
• bace1b8 libnetwork/d/overlay: handle coalesced peer updates
• f9e5429 libn/d/win/overlay: dedupe NetworkDB definitions
• fc3df55 libn/d/overlay: extract hashable address types
• b22872a libnetwork/driverapi: make EventNotify optional
• c7e17ae libn/networkdb: report prev value in update events
• d60c71a libnetwork/d/overlay: fix logical race conditions
• ad54b8f libn/d/overlay: fix encryption race conditions
• 8075689 libn/d/overlay: inline secMapWalk into only caller
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v4 from 4.18.1 to 4.18.2

Changelog

Sourced from github.com/jackc/pgx/v4's changelog.

4.18.2 (March 4, 2024)

Fix CVE-2024-27289

SQL injection can occur when all of the following conditions are met:

1. The non-default simple protocol is used.
2. A placeholder for a numeric value must be immediately preceded by a minus.
3. There must be a second placeholder for a string value after the first placeholder; both must be on the same line.
4. Both parameter values must be user-controlled.

Thanks to Paul Gerste for reporting this issue.

Fix CVE-2024-27304

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Thanks to Paul Gerste for reporting this issue.

• Fix *dbTx.Exec not checking if it is already closed

Commits

• 14690df Update changelog
• 779548e Update required Go version to 1.17
• 80e9662 Update github.com/jackc/pgconn to v1.14.3
• 0bf9ac3 Fix erroneous test case
• f94eb0e Always wrap arguments in parentheses in the SQL sanitizer
• 826a892 Fix SQL injection via line comment creation in simple protocol
• 7d882f9 Fix *dbTx.Exec not checking if it is already closed
• 1d07b8b go mod tidy
• See full diff in compare view

Updates github.com/jackc/pgx/v5 from 5.3.1 to 5.5.2

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.5.2 (January 13, 2024)

• Allow NamedArgs to start with underscore
• pgproto3: Maximum message body length support (jeremy.spriet)
• Upgrade golang.org/x/crypto to v0.17.0
• Add snake_case support to RowToStructByName (Tikhon Fedulov)
• Fix: update description cache after exec prepare (James Hartig)
• Fix: pipeline checks if it is closed (James Hartig and Ryan Fowler)
• Fix: normalize timeout / context errors during TLS startup (Samuel Stauffer)
• Add OnPgError for easier centralized error handling (James Hartig)

5.5.1 (December 9, 2023)

• Add CopyFromFunc helper function. (robford)
• Add PgConn.Deallocate method that uses PostgreSQL protocol Close message.
• pgx uses new PgConn.Deallocate method. This allows deallocating statements to work in a failed transaction. This fixes a case where the prepared statement map could become invalid.
• Fix: Prefer driver.Valuer over json.Marshaler for json fields. (Jacopo)
• Fix: simple protocol SQL sanitizer previously panicked if an invalid $0 placeholder was used. This now returns an error instead. (maksymnevajdev)
• Add pgtype.Numeric.ScanScientific (Eshton Robateau)

5.5.0 (November 4, 2023)

• Add CollectExactlyOneRow. (Julien GOTTELAND)
• Add OpenDBFromPool to create *database/sql.DB from *pgxpool.Pool. (Lev Zakharov)
• Prepare can automatically choose statement name based on sql. This makes it easier to explicitly manage prepared statements.
• Statement cache now uses deterministic, stable statement names.
• database/sql prepared statement names are deterministically generated.
• Fix: SendBatch wasn't respecting context cancellation.
• Fix: Timeout error from pipeline is now normalized.
• Fix: database/sql encoding json.RawMessage to []byte.
• CancelRequest: Wait for the cancel request to be acknowledged by the server. This should improve PgBouncer compatibility. (Anton Levakin)
• stdlib: Use Ping instead of CheckConn in ResetSession
• Add json.Marshaler and json.Unmarshaler for Float4, Float8 (Kirill Mironov)

5.4.3 (August 5, 2023)

• Fix: QCharArrayOID was defined with the wrong OID (Christoph Engelbert)
• Fix: connect_timeout for sslmode=allow|prefer (smaher-edb)
• Fix: pgxpool: background health check cannot overflow pool
• Fix: Check for nil in defer when sending batch (recover properly from panic)
• Fix: json scan of non-string pointer to pointer
• Fix: zeronull.Timestamptz should use pgtype.Timestamptz
• Fix: NewConnsCount was not correctly counting connections created by Acquire directly. (James Hartig)
• RowTo(AddrOf)StructByPos ignores fields with "-" db tag
• Optimization: improve text format numeric parsing (horpto)

5.4.2 (July 11, 2023)

• Fix: RowScanner errors are fatal to Rows
• Fix: Enable failover efforts when pg_hba.conf disallows non-ssl connections (Brandon Kauffman)

... (truncated)

Commits

• b7de418 Release v5.5.2
• b99e2bb Document max read and write sizes for large objects
• 52f2151 Allow NamedArgs to start with underscore
• dfb6489 fix typo in doc.go
• 9346d48 fix OpenDBFromPool example
• 1fdd170 feat(pgproto3): expose MaxExpectedBodyLen and ActualBodyLen in ExceededMaxBod...
• f654d61 Make note about possible parse config error message redaction change
• 5d26bbe Make pgconn.ConnectError and pgconn.ParseConfigError public
• 44768b5 fix a typo in config_test.go
• 6f2ce92 Upgrade golang.org/x/crypto to v0.17.0
• Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.8.0 to 0.30.0

Commits

• cf14319 oauth2: fix expiration time window check
• 32d34ef internal: include clientID in auth style cache key
• 2d34e30 oauth2: replace a magic number with AuthStyleUnknown
• 696f7b3 all: modernize with doc links and any
• 471209b oauth2: drop dependency on go-cmp
• 6968da2 oauth2: sync Token.ExpiresIn from internal Token
• d2c4e0a oauth2: context instead of golang.org/x/net/context in doc
• 883dc3c endpoints: add various endpoints from stale CLs
• 1c06e87 all: make use of oauth.Token.ExpiresIn
• 65c15a3 oauth2: remove extra period
• Additional commits viewable in compare view

Updates github.com/dvsekhvalnov/jose2go from 1.5.0 to 1.7.0

Commits

• 0a0673d Merge pull request #34 from dvsekhvalnov/issue-33-deflate-limit
• c3fff7c docs
• e51b47f docs
• c7dde52 fixing workflow
• a194baa added go versions and OSs to matrix
• f31cfc6 fixing yaml
• 1a4ba55 added matrix to workflow
• d2baff2 go workflow
• b14c81a added limitation for deflate decompression stream
• 48ba0b7 Merge pull request #32 from dvsekhvalnov/issue-31-security-tuning
• Additional commits viewable in compare view

Updates github.com/golang-jwt/jwt/v4 from 4.4.2 to 4.5.2

Release notes

Sourced from github.com/golang-jwt/jwt/v4's releases.

v4.5.2

See GHSA-mh63-6h87-95cp

Full Changelog: golang-jwt/jwt@v4.5.1...v4.5.2

v4.5.1

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

• Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

v4.5.0

What's Changed

• Allow strict base64 decoding by @​AlexanderYastrebov in golang-jwt/jwt#259

Full Changelog: golang-jwt/jwt@v4.4.3...v4.5.0

v4.4.3

What's Changed

• fix: link update for README.md for v4 by @​krokite in golang-jwt/jwt#217
• Implement a BearerExtractor by @​WhyNotHugo in golang-jwt/jwt#226
• Bump matrix to support latest go version (go1.19) by @​mfridman in golang-jwt/jwt#231
• Include https://github.com/golang-jwt/jwe in README by @​oxisto in golang-jwt/jwt#229
• Add doc comment to ParseWithClaims by @​jkopczyn in golang-jwt/jwt#232
• Refactor: removed the unneeded if statement by @​Krout0n in golang-jwt/jwt#241
• No pointer embedding in the example by @​oxisto in golang-jwt/jwt#255

New Contributors

• @​krokite made their first contribution in golang-jwt/jwt#217
• @​WhyNotHugo made their first contribution in golang-jwt/jwt#226
• @​jkopczyn made their first contribution in golang-jwt/jwt#232
• @​Krout0n made their first contribution in golang-jwt/jwt#241

Full Changelog: golang-jwt/jwt@v4.4.2...v4.4.3

Commits

• 2f0e9ad Backporting 0951d18 to v4
• 7b1c1c0 Merge commit from fork
• 9358574 Allow strict base64 decoding (#259)
• 2f0984a Using tparse for nicer CI test display (#251)
• 2101c1f No pointer embedding in the example (#255)
• 35053d4 Removed unneeded if statement (#241)
• 0c4e387 Add doc comment to ParseWithClaims (#232)
• bfea432 Include https://github.com/golang-jwt/jwe in README (#229)
• d81acbf Bump matrix to support latest go version (go1.19) (#231)
• fdaf0eb Implement a BearerExtractor (#226)
• Additional commits viewable in compare view

Updates github.com/jackc/pgproto3/v2 from 2.3.2 to 2.3.3

Commits

• 945c212 Backport fixes from pgx v5
• See full diff in compare view

Updates golang.org/x/crypto from 0.9.0 to 0.41.0

Commits

• ef5341b go.mod: update golang.org/x dependencies
• b999374 acme: fix pebble subprocess output data race
• c247dea x509roots/fallback: store bundle certs directly in DER
• 1fda731 acme: increase pebble test waitForServer attempts
• 1b4c3d2 x509roots/fallback: update bundle
• b903b53 acme: capture pebble test subprocess stdout/stderr
• 459a9db go.mod: update golang.org/x dependencies
• 74e709a ssh: add AlgorithmNegotiationError
• b3790b8 acme: fix TLSALPN01ChallengeCert for IP address identifiers
• 1dc4269 acme: add Pebble integration testing
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.10.0 to 0.43.0

Commits

• e74bc31 go.mod: update golang.org/x dependencies
• af6926e http2: remove references to defunct http2.golang.org test server
• 76358aa go.mod: update golang.org/x dependencies
• 6e41cae go.mod: update golang.org/x dependencies
• 15f7d40 http2: correctly wrap ErrFrameTooLarge in Framer.ReadFrame
• ef33bc0 internal/http3: use bubbled context in synctest tests
• 919c6bc http2: use an array instead of a map in typeFrameParser
• bae01a7 trace: add missing td tag
• 7d6e62a go.mod: update golang.org/x dependencies
• ea0c1d9 internal/timeseries: use built-in max/min to simplify the code
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.55.0 to 1.75.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.75.0

Behavior Changes

• xds: Remove support for GRPC_EXPERIMENTAL_XDS_FALLBACK environment variable. Fallback support can no longer be disabled. (#8482)
• stats: Introduce DelayedPickComplete event, a type alias of PickerUpdated. (#8465)
  • This (combined) event will now be emitted only once per call, when a transport is successfully selected for the attempt.
  • OpenTelemetry metrics will no longer have multiple "Delayed LB pick complete" events in Go, matching other gRPC languages.
  • A future release will delete the PickerUpdated symbol.
• credentials: Properly apply grpc.WithAuthority as the highest-priority option for setting authority, above the setting in the credentials themselves. (#8488)
  • Now that this WithAuthority is available, the credentials should not be used to override the authority.
• round_robin: Randomize the order in which addresses are connected to in order to spread out initial RPC load between clients. (#8438)
• server: Return status code INTERNAL when a client sends more than one request in unary and server streaming RPC. (#8385)
  • This is a behavior change but also a bug fix to bring gRPC-Go in line with the gRPC spec.

New Features

• dns: Add an environment variable (GRPC_ENABLE_TXT_SERVICE_CONFIG) to provide a way to disable TXT lookups in the DNS resolver (by setting it to false). By default, TXT lookups are enabled, as they were previously. (#8377)

Bug Fixes

• xds: Fix regression preventing empty node IDs in xDS bootstrap configuration. (#8476)
  • Special Thanks: @​davinci26
• xds: Fix possible panic when certain invalid resources are encountered. (#8412)
  • Special Thanks: @​wooffie
• xdsclient: Fix a rare panic caused by processing a response from a closed server. (#8389)
• stats: Fix metric unit formatting by enclosing non-standard units like call and endpoint in curly braces to comply with UCUM and gRPC OpenTelemetry guidelines. (#8481)
• xds: Fix possible panic when clusters are removed from the xds configuration. (#8428)
• xdsclient: Fix a race causing "resource doesn not exist" when rapidly subscribing and unsubscribing to the same resource. (#8369)
• client: When determining the authority, properly percent-encode (if needed, which is unlikely) when the target string omits the hostname and only specifies a port (grpc.NewClient(":<port-number-or-name>")). (#8488)

Release 1.74.3

Bug Fixes

• xds: Fix a regression preventing empty node IDs in the bootstrap configuration. (#8476 , #8483)
• xdsclient: Fix a data race caused while reporting load to LRS. (#8483)
• server: Fix a regression preventing streams from being cancelled or timed out when blocked on flow control. (#8528)

Release 1.74.2

New Features

• grpc: introduce new DialOptions and ServerOptions (WithStaticStreamWindowSize, WithStaticConnWindowSize, StaticStreamWindowSize, StaticConnWindowSize) that force fixed window sizes for all HTTP/2 connections. By default, gRPC uses dynamic sizing of these windows based upon a BDP estimation algorithm. The existing options (WithInitialWindowSize, etc) also disable BDP estimation, but this behavior will be changed in a following release. (#8283)

API Changes

• balancer: add ExitIdle method to Balancer interface. Earlier, implementing this method was optional. (#8367)

Behavior Changes

• xds: Remove the GRPC_EXPERIMENTAL_ENABLE_LEAST_REQUEST environment variable that allows disabling the least request balancer with xDS. Least request was made available by default with xDS in v1.72.0. (#8248)
  • Special Thanks: @​atollena

... (truncated)

Commits

• b9788ef Change version to 1.75.0 (#8493)
• 2bd74b2 credentials: fix behavior of grpc.WithAuthority and credential handshake prec...
• 9fa3267 xds: remove xds client fallback environment variable (#8482)
• 62ec29f grpc: Fix cardinality violations in non-client streaming RPCs. (#8385)
• 85240a5 stats: change non-standard units to annotations (#8481)
• ac13172 update deps (#8478)
• 0a895bc examples/opentelemetry: use experimental metrics in example (#8441)
• 8b61e8f xdsclient: do not process updates from closed server channels (#8389)
• 7238ab1 Allow empty nodeID (#8476)
• 9186ebd cleanup: use slices.Equal to simplify code (#8472)
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.30.0 to 1.36.8

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.