cloud/ocis
1
0
Fork 0
mirror of https://github.com/owncloud/ocis.git synced 2026-10-23 23:29:02 +03:00
Code Activity
23,048 Commits 164 Branches 209 Tags
remove-owncloudsql
Commit Graph

15 Commits

Author SHA1 Message Date
Michal Klos
b9077d96d8 chore(deps): consolidate dependency and security bumps (#13081) 
* chore(deps): consolidate dependency and security bumps

Dependabot PRs applied:
- #12878 qs 6.15.2 -> 6.16.0 (web/web-runtime)
- #13013 alpine 3.24.1 -> 3.24.2
- #13061 actions/checkout -> v7.0.1 (missed instance in k8s.yml)
- #13062 actions/setup-node -> v7.0.0 (missed instance in k8s.yml)
- #13075 simple-git 3.36.0 -> 4.0.1 (security)
- #13076 katex 0.16.45 -> 0.18.2+ (security)
- #13077 dompurify 3.4.13 -> 3.4.16 (security)
- #13079 go deps minor-and-patch group, 18 updates (opa 1.19.0 -> 1.21.1, otel 1.46 -> 1.47, bleve, govips, grpc-gateway, lico, tablewriter, logrus, gjson, x/exp, x/image, genproto, etc.)

Skipped (already satisfied on master): #12513, #12624, #12625, #12633

Manual security bumps via pnpm.overrides (no dependabot PR existed):
- axios -> 1.20.0
- smol-toml -> 1.9.0
- postcss -> 8.5.23
- postcss-selector-parser -> 7.1.6
- colord -> 2.9.4
- unhead -> 2.1.13
- markdown-it -> 14.3.1
- esbuild -> 0.28.1
- brace-expansion 5.0.11 -> 5.0.12

Not fixable: sprintf-js and elliptic have no patched version released upstream yet; left as-is.

go build and pnpm install verified clean.

* chore(deps): fix residual transitive vulns found by trivy

trivy flagged duplicate/stale resolutions that survived the earlier
override pass: dompurify (3.4.12 -> 3.4.16), qs (6.14.2 -> 6.16.0),
and fast-uri (3.1.7 -> 3.1.8, CVE-2026-86472). Added/bumped pnpm.overrides
accordingly. trivy fs scan of web/pnpm-lock.yaml now clean.

* chore(deps): bump reva to bac0e1ee144ab853a81c6b02142032f102dd245a

Pins github.com/owncloud/reva/v2 to bac0e1ee144ab853a81c6b02142032f102dd245a,
pulling in its go-playground/locales and huandu/xstrings version bumps.
Appends this PR to changelog/unreleased/bump-reva.md.

go build ./... verified clean after go mod vendor resync.

* fix(ci): revert unhead override, breaks web build

* revert: keep k8s.yml actions/checkout and setup-node pinned
 2026-10-07 07:56:56 +02:00
dependabot[bot]
9b1ba66a5a build(deps): bump the minor-and-patch group with 18 updates (#12357) 
Bumps the minor-and-patch group with 18 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/blevesearch/bleve/v2](https://github.com/blevesearch/bleve) | `2.5.7` | `2.6.0` |
| [github.com/davidbyttow/govips/v2](https://github.com/davidbyttow/govips) | `2.16.0` | `2.18.0` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.2.5` | `5.3.0` |
| [github.com/gookit/config/v2](https://github.com/gookit/config) | `2.2.7` | `2.2.8` |
| [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) | `2.28.0` | `2.29.0` |
| [github.com/kovidgoyal/imaging](https://github.com/kovidgoyal/imaging) | `1.8.19` | `1.8.21` |
| [github.com/libregraph/lico](https://github.com/libregraph/lico) | `0.66.0` | `0.67.0` |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.14.0` | `2.14.1` |
| [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) | `1.51.0` | `1.52.0` |
| [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) | `1.1.0` | `1.1.4` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.40.0` | `1.41.0` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.12.3` | `1.16.2` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.18.0` | `1.19.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.66.0` | `0.68.0` |
| [go.opentelemetry.io/contrib/zpages](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.64.0` | `0.68.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.51.0` | `0.52.0` |
| [golang.org/x/image](https://github.com/golang/image) | `0.39.0` | `0.41.0` |
| [google.golang.org/genproto/googleapis/api](https://github.com/googleapis/go-genproto) | `0.0.0-20260401024825-9d38bb4040a9` | `0.0.0-20260414002931-afd174a4e478` |


Updates `github.com/blevesearch/bleve/v2` from 2.5.7 to 2.6.0
- [Release notes](https://github.com/blevesearch/bleve/releases)
- [Commits](https://github.com/blevesearch/bleve/compare/v2.5.7...v2.6.0)

Updates `github.com/davidbyttow/govips/v2` from 2.16.0 to 2.18.0
- [Release notes](https://github.com/davidbyttow/govips/releases)
- [Commits](https://github.com/davidbyttow/govips/compare/v2.16.0...v2.18.0)

Updates `github.com/go-chi/chi/v5` from 5.2.5 to 5.3.0
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0)

Updates `github.com/gookit/config/v2` from 2.2.7 to 2.2.8
- [Release notes](https://github.com/gookit/config/releases)
- [Commits](https://github.com/gookit/config/compare/v2.2.7...v2.2.8)

Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.28.0 to 2.29.0
- [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases)
- [Commits](https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.28.0...v2.29.0)

Updates `github.com/kovidgoyal/imaging` from 1.8.19 to 1.8.21
- [Release notes](https://github.com/kovidgoyal/imaging/releases)
- [Commits](https://github.com/kovidgoyal/imaging/compare/v1.8.19...v1.8.21)

Updates `github.com/libregraph/lico` from 0.66.0 to 0.67.0
- [Changelog](https://github.com/libregraph/lico/blob/master/CHANGELOG.md)
- [Commits](https://github.com/libregraph/lico/compare/v0.66.0...v0.67.0)

Updates `github.com/nats-io/nats-server/v2` from 2.14.0 to 2.14.1
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](https://github.com/nats-io/nats-server/compare/v2.14.0...v2.14.1)

Updates `github.com/nats-io/nats.go` from 1.51.0 to 1.52.0
- [Release notes](https://github.com/nats-io/nats.go/releases)
- [Commits](https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0)

Updates `github.com/olekukonko/tablewriter` from 1.1.0 to 1.1.4
- [Release notes](https://github.com/olekukonko/tablewriter/releases)
- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.1.0...v1.1.4)

Updates `github.com/onsi/gomega` from 1.40.0 to 1.41.0
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.40.0...v1.41.0)

Updates `github.com/open-policy-agent/opa` from 1.12.3 to 1.16.2
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-policy-agent/opa/compare/v1.12.3...v1.16.2)

Updates `github.com/tidwall/gjson` from 1.18.0 to 1.19.0
- [Commits](https://github.com/tidwall/gjson/compare/v1.18.0...v1.19.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.66.0 to 0.68.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.66.0...zpages/v0.68.0)

Updates `go.opentelemetry.io/contrib/zpages` from 0.64.0 to 0.68.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.64.0...zpages/v0.68.0)

Updates `golang.org/x/crypto` from 0.51.0 to 0.52.0
- [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0)

Updates `golang.org/x/image` from 0.39.0 to 0.41.0
- [Commits](https://github.com/golang/image/compare/v0.39.0...v0.41.0)

Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20260401024825-9d38bb4040a9 to 0.0.0-20260414002931-afd174a4e478
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: github.com/blevesearch/bleve/v2
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/davidbyttow/govips/v2
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/gookit/config/v2
  dependency-version: 2.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2
  dependency-version: 2.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/kovidgoyal/imaging
  dependency-version: 1.8.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/libregraph/lico
  dependency-version: 0.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/nats-io/nats.go
  dependency-version: 1.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/olekukonko/tablewriter
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/tidwall/gjson
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.opentelemetry.io/contrib/zpages
  dependency-version: 0.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/image
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google.golang.org/genproto/googleapis/api
  dependency-version: 0.0.0-20260414002931-afd174a4e478
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-26 09:38:46 +02:00
Roman Perekhod
32b454d41e chore: [full-ci] bump dependencies 2025-07-07 16:29:24 +02:00
dependabot[bot]
e08899d224 chore(deps): bump github.com/libregraph/lico from 0.64.0 to 0.65.0 
Bumps [github.com/libregraph/lico](https://github.com/libregraph/lico) from 0.64.0 to 0.65.0.
- [Changelog](https://github.com/libregraph/lico/blob/master/CHANGELOG.md)
- [Commits](https://github.com/libregraph/lico/compare/v0.64.0...v0.65.0)

---
updated-dependencies:
- dependency-name: github.com/libregraph/lico
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-12-04 09:19:55 +01:00
dependabot[bot]
114b519416 chore(deps): bump github.com/libregraph/lico from 0.62.0 to 0.64.0 
Bumps [github.com/libregraph/lico](https://github.com/libregraph/lico) from 0.62.0 to 0.64.0.
- [Changelog](https://github.com/libregraph/lico/blob/master/CHANGELOG.md)
- [Commits](https://github.com/libregraph/lico/compare/v0.62.0...v0.64.0)

---
updated-dependencies:
- dependency-name: github.com/libregraph/lico
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-09-30 09:32:18 +02:00
Ralf Haferkamp
62dbf737c7 Bump lico to latest release 2024-05-08 17:57:35 +02:00
dependabot[bot]
38699ca1e1 build(deps): bump github.com/libregraph/idm 
Bumps [github.com/libregraph/idm](https://github.com/libregraph/idm) from 0.4.1-0.20240410123343-a51b459380d0 to 0.5.0.
- [Changelog](https://github.com/libregraph/idm/blob/master/CHANGELOG.md)
- [Commits](https://github.com/libregraph/idm/commits/v0.5.0)

---
updated-dependencies:
- dependency-name: github.com/libregraph/idm
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-23 09:29:42 +02:00
Ralf Haferkamp
8c203a144f bump libregraph/idm to lastest master 2024-04-10 15:21:34 +02:00
Florian Schade
6840de574a enhancement: same site strict cookies (#8716) 
To enhance the security of our application and prevent Cross-Site Request Forgery (CSRF) attacks, we have updated the
SameSite attribute of the build in Identity Provider (IDP) cookies to Strict.
 2024-03-25 10:16:10 +01:00
dependabot[bot]
d2d4fcd43b build(deps): bump github.com/libregraph/lico from 0.61.1 to 0.61.2 
Bumps [github.com/libregraph/lico](https://github.com/libregraph/lico) from 0.61.1 to 0.61.2.
- [Changelog](https://github.com/libregraph/lico/blob/master/CHANGELOG.md)
- [Commits](https://github.com/libregraph/lico/compare/v0.61.1...v0.61.2)

---
updated-dependencies:
- dependency-name: github.com/libregraph/lico
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-02-21 09:09:23 +01:00
Roman Perekhod
2745669feb fixed the issue that led to correct update but the 404 response code when renaming an existing user to a string with capital letters 2023-12-14 12:10:37 +01:00
dependabot[bot]
a6a6c22c14 chore(deps): bump github.com/libregraph/lico 
Bumps [github.com/libregraph/lico](https://github.com/libregraph/lico) from 0.60.1-0.20230811070109-1d4140be554d to 0.61.1.
- [Changelog](https://github.com/libregraph/lico/blob/master/CHANGELOG.md)
- [Commits](https://github.com/libregraph/lico/commits/v0.61.1)

---
updated-dependencies:
- dependency-name: github.com/libregraph/lico
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-05 09:40:36 +01:00
Ralf Haferkamp
1e625093b6 Bump libregraph/lico to latest master 
This is need for getting this fix: libregraph/lico#104
 2023-08-17 10:19:21 +02:00
Ralf Haferkamp
6c6ec2db48 Bump libregraph/lico to latest master 
This is need for getting this fix: libregraph/lico#95
 2023-05-16 17:25:55 +02:00
Michael Barz
afc6ed1e41 switch to go vendoring 2023-04-19 20:24:34 +02:00