Bump github.com/hashicorp/vault/sdk from 0.3.0 to 0.5.0

[dependabot]

Bumps github.com/hashicorp/vault/sdk from 0.3.0 to 0.5.0.

Changelog

Sourced from github.com/hashicorp/vault/sdk's changelog.

0.5.0 (February 10, 2016)

SECURITY:

• Previous versions of Vault could allow a malicious user to hijack the rekey operation by canceling an operation in progress and starting a new one. The practical application of this is very small. If the user was an unseal key owner, they could attempt to do this in order to either receive unencrypted reseal keys or to replace the PGP keys used for encryption with ones under their control. However, since this would invalidate any rekey progress, they would need other unseal key holders to resubmit, which would be rather suspicious during this manual operation if they were not also the original initiator of the rekey attempt. If the user was not an unseal key holder, there is no benefit to be gained; the only outcome that could be attempted would be a denial of service against a legitimate rekey operation by sending cancel requests over and over. Thanks to Josh Snyder for the report!

DEPRECATIONS/CHANGES:

• s3 physical backend: Environment variables are now preferred over configuration values. This makes it behave similar to the rest of Vault, which, in increasing order of preference, uses values from the configuration file, environment variables, and CLI flags. GH-871
• etcd physical backend: sync functionality is now supported and turned on by default. This can be disabled. GH-921
• transit: If a client attempts to encrypt a value with a key that does not yet exist, what happens now depends on the capabilities set in the client's ACL policies. If the client has create (or create and update) capability, the key will upsert as in the past. If the client has update capability, they will receive an error. GH-1012
• token-renew CLI command: If the token given for renewal is the same as the client token, the renew-self endpoint will be used in the API. Given that the default policy (by default) allows all clients access to the renew-self endpoint, this makes it much more likely that the intended operation will be successful. GH-894
• Token lookup: the ttl value in the response now reflects the actual remaining TTL rather than the original TTL specified when the token was created; this value is now located in creation_ttl GH-986
• Vault no longer uses grace periods on leases or token TTLs. Uncertainty about the length grace period for any given backend could cause confusion and uncertainty. GH-1002
• rekey: Rekey now requires a nonce to be supplied with key shares. This nonce is generated at the start of a rekey attempt and is unique for that attempt.
• status: The exit code for the status CLI command is now 2 for an uninitialized Vault instead of 1. 1 is returned for errors. This better matches the rest of the CLI.

FEATURES:

... (truncated)

Commits

• a7b0aad Cut version 0.5.0
• 11151af Add change of exit code for status to upgrade page
• 7b3e027 changelog++
• 4e7c92f changelog++
• ef8086b Update documentation for status command to reflect new return codes
• 44a412f changelog++
• a1fcf20 Merge pull request #1036 from hashicorp/tls-notbefore-skew
• 122773b Add slack on NotBefore value for generated certs.
• 71468c9 changelog++
• f7e228a changelog++
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coveralls]

Coverage remained the same at 33.856% when pulling a515f1b on dependabot/go_modules/github.com/hashicorp/vault/sdk-0.5.0 into c12275f on main.

[dependabot]

Superseded by #146.