Skip to content

Bump github.com/gin-contrib/cors from 1.5.0 to 1.7.2#21

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/gin-contrib/cors-1.7.2
Open

Bump github.com/gin-contrib/cors from 1.5.0 to 1.7.2#21
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/gin-contrib/cors-1.7.2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 6, 2024

Bumps github.com/gin-contrib/cors from 1.5.0 to 1.7.2.

Release notes

Sourced from github.com/gin-contrib/cors's releases.

v1.7.2

Changelog

Enhancements

  • f952c06051ba36d87edf074af15b36a56e5d6e16: chore: improve changelog generation and categorization (@​appleboy)
  • c4d5284215fd8858cb5b88b3c5d5fab2a6b43d91: chore: update dependencies and refactor imports (@​appleboy)

Build process updates

  • 064064f7214ebfe75a019e6534b92f1ce709065e: ci: update Go workflow linting action to v5 (@​appleboy)

v1.7.1

Changelog

Enhancements

  • 71a48a2 chore: update third-party dependencies to latest versions

Others

  • 88cbcd0 ci: update GitHub Actions workflows for Go projects
  • 84d0919 test: refactor CORS tests and expand coverage

v1.7.0

Changelog

Bug fixes

  • 7f30a1f fix: improve error handling and test robustness

Enhancements

  • 9d49f16 chore(cors): Allow a custom validation function which receives the full gin context (#140)

Others

  • 4447aeb refactor: refactor request handling and improve CORS checks

v1.6.0

Changelog

Features

  • eac6c48 feat(schema): allow usage of custom schemas (#139)

Bug fixes

Enhancements

  • f41df75 chore: update GitHub actions to latest versions
  • 2451987 chore: update dependencies to latest versions
  • 7d356c2 chore: update dependencies to latest versions
  • 5da0aee chore: update third-party dependencies
  • 8263fce chore: update version of actions/setup-go in GitHub workflows

Others

  • fcbd06f ci: enhance testing matrix and tolerance limits
  • f08c1bc ci: refactor CI workflows and improve tests
  • 30792dc ci: refactor GitHub Actions workflows
  • 0e993b7 ci: update GitHub Actions to Version 3
  • 90a7c66 test(cors): enhance CORS wildcard handling tests (#145)
  • 85bf9fb test: improve CORS wildcard handling and testing (#144)
  • d5002f2 test: refactor tests and update CI configurations
Commits
  • 064064f ci: update Go workflow linting action to v5
  • c4d5284 chore: update dependencies and refactor imports
  • f952c06 chore: improve changelog generation and categorization
  • 71a48a2 chore: update third-party dependencies to latest versions
  • 88cbcd0 ci: update GitHub Actions workflows for Go projects
  • 84d0919 test: refactor CORS tests and expand coverage
  • 4447aeb refactor: refactor request handling and improve CORS checks
  • 9d49f16 chore(cors): Allow a custom validation function which receives the full gin c...
  • 7f30a1f fix: improve error handling and test robustness
  • 90a7c66 test(cors): enhance CORS wildcard handling tests (#145)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump github.com/gin-contrib/cors from 1.5.0 to 1.7.2
fc160b4 
Bumps [github.com/gin-contrib/cors](https://github.com/gin-contrib/cors) from 1.5.0 to 1.7.2.
- [Release notes](https://github.com/gin-contrib/cors/releases)
- [Changelog](https://github.com/gin-contrib/cors/blob/master/.goreleaser.yaml)
- [Commits](gin-contrib/cors@v1.5.0...v1.7.2)

---
updated-dependencies:
- dependency-name: github.com/gin-contrib/cors
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 6, 2024
@dependabot dependabot Bot mentioned this pull request May 6, 2024
Closed
@dryrunsecurity
Copy link
Copy Markdown

dryrunsecurity Bot commented May 6, 2024 •
edited
Loading

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Configured Codepaths Analyzer ✅ 0 findings
Secrets Analyzer ✅ 0 findings
AppSec Analyzer ✅ 0 findings
Authn/Authz Analyzer ✅ 0 findings
Sensitive Files Analyzer ❕ 2 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖.
Note that this summary is auto-generated and not meant to be a definitive list of security issues
but rather a helpful summary from a security perspective.

Summary:

The changes in this pull request primarily focus on updating the dependencies in the go.mod and go.sum files. The updates include version changes for several dependencies, as well as the removal of the github.com/chenzhuoyu/iasm dependency and the addition of github.com/bytedance/sonic/loader, github.com/cloudwego/base64x, and github.com/cloudwego/iasm dependencies.

From an application security perspective, the changes do not appear to introduce any significant security risks. Updating dependencies is a common practice to address known vulnerabilities, improve performance, or add new features. However, it is always recommended to thoroughly review the changes and the release notes of the updated dependencies to ensure that there are no known security vulnerabilities introduced.

Additionally, it is a good practice to have a well-defined and automated process for updating dependencies, including thorough testing and a review of the changes before merging them into the main codebase.

Files Changed:

  1. go.mod: The changes in this file include updating the versions of several dependencies, such as github.com/bytedance/sonic, github.com/cloudwego/base64x, github.com/cloudwego/iasm, github.com/gabriel-vasile/mimetype, github.com/go-playground/validator/v10, github.com/klauspost/cpuid/v2, github.com/leodido/go-urn, github.com/mattn/go-isatty, github.com/pelletier/go-toml/v2, github.com/ugorji/go/codec, golang.org/x/arch, golang.org/x/crypto, golang.org/x/net, golang.org/x/sys, and google.golang.org/protobuf. The changes also include removing the github.com/chenzhuoyu/iasm dependency and adding github.com/bytedance/sonic/loader, github.com/cloudwego/base64x, and github.com/cloudwego/iasm dependencies.

  2. go.sum: The changes in this file reflect the updated versions of the dependencies mentioned in the go.mod file. It's important to review the changes to ensure that there are no known security vulnerabilities in the updated dependencies.

Powered by DryRun Security

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants