Bump the go-modules group across 1 directory with 6 updates

[dependabot]

Bumps the go-modules group with 3 updates in the / directory: github.com/argoproj/argo-cd/v3, github.com/getsops/sops/v3 and golang.org/x/crypto.

Updates github.com/argoproj/argo-cd/v3 from 3.4.3 to 3.4.4

Release notes

Sourced from github.com/argoproj/argo-cd/v3's releases.

v3.4.4

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.4/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.4/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 146184ea41fa545e0a084c82f05cfe5bd07a9ff9: fix(health): PromotionStrategy stuck Progressing after no-op re-hydration (#28124) (cherry-pick #28125 for 3.4) (#28135) (@​argo-cd-cherry-pick-bot[bot])
• e515f51ab1ca500a165b49ca9ec9c402279b6768: fix(rbac): resolve RBAC regression for project-scoped resources in multi-namespace architecture (#25289) (#26573) (#28062) (@​wanddynosios)
• 7f2fe9576c6b426f00b04abe6dea55cc9cf634c3: fix(ssd): regression causing diff to error on new objects (#27679) (cherry-pick #27703 for 3.4) (#28241) (@​argo-cd-cherry-pick-bot[bot])
• 5199ea6cb74471e22b9c007b0c4598575bb37e44: fix: add a lock on clusterinformer (cherry-pick #28216 for 3.4) (#28312) (@​blakepettersson)
• 7a64081225fe7e9688cd7a3d0ad0ff2bc62fde78: fix: exclude live status from normalization (cherry-pick #28201 for 3.4) (#28204) (@​argo-cd-cherry-pick-bot[bot])
• 0b3436ffe67564506a49007970daa3d9f476856d: fix: fixes parsing of dex passwords with dollar sign (cherry pick of #28027 to 3.4) (#28197) (@​ppapapetrou76)
• 9ccf66b8fc4500d90091075debed86dc218a3981: fix: resolve cross-generator Values templates in RenderGeneratorParams (#27827) (cherry-pick #27830 for 3.4) (#28128) (@​argo-cd-cherry-pick-bot[bot])

Other work

• 14ad471bf6102535664cac3b43cb706904c72b35: Merge pull request #28162 from argoproj/cherry-pick-28158-to-release-3.4 (@​dudinea)
• 0fd000b25fb94fbc2de25dd3c97417e44d28a629: Merge pull request #28164 from argoproj/cherry-pick-28155-to-release-3.4 (@​dudinea)
• ff255193d14b0ab7ecf7bea48c9cfda3cc0de46a: chore(ci): bump codecov action to 7.0.0 to fix the GPG issue (cherry-pick #28159 for 3.4) (#28172) (@​dudinea)
• e9ff0c571b905989d517ac377c4071b6b6180081: ci: bump goreleaser (cherry-pick #28033 for 3.4) (#28072) (@​argo-cd-cherry-pick-bot[bot])
• 1c5e37da077808446895092764bd14312c53d76d: ci: use github release notes in goreleaser (cherry-pick #28048 for 3.4) (#28071) (@​argo-cd-cherry-pick-bot[bot])
• 0c14cfb5117526dd35657e0fddd21c5c612664be: fix(manifest-generate-paths): Normalize repo before using type repo (#28113) (@​fm1ck3y)
• c2003f447e49a183b75e3d94e7982c59c012bd5e: test(e2e): Add test for second Sync after initial for different resources/options (#28156) (#28155) (@​dudinea)
• 9810fa2902e60e48df2acda2353f44b293d4203f: test(e2e): fix cleanup of CRDs for e2e tests (#28157) (#28158) (@​dudinea)

Full Changelog: argoproj/argo-cd@v3.4.3...v3.4.4

Commits

• 443415b Bump version to 3.4.4 on release-3.4 branch (#28326)
• 5199ea6 fix: add a lock on clusterinformer (cherry-pick #28216 for 3.4) (#28312)
• 7f2fe95 fix(ssd): regression causing diff to error on new objects (#27679) (cherry-pi...
• 7a64081 fix: exclude live status from normalization (cherry-pick #28201 for 3.4) (#28...
• 0c14cfb fix(manifest-generate-paths): Normalize repo before using type repo (#28113)
• e515f51 fix(rbac): resolve RBAC regression for project-scoped resources in multi-name...
• 0b3436f fix: fixes parsing of dex passwords with dollar sign (cherry pick of #28027 t...
• ff25519 chore(ci): bump codecov action to 7.0.0 to fix the GPG issue (cherry-pick #28...
• 14ad471 Merge pull request #28162 from argoproj/cherry-pick-28158-to-release-3.4
• 0fd000b Merge pull request #28164 from argoproj/cherry-pick-28155-to-release-3.4
• Additional commits viewable in compare view

Updates github.com/getsops/sops/v3 from 3.13.1 to 3.13.2

Release notes

Sourced from github.com/getsops/sops/v3's releases.

v3.13.2

Installation

To install sops, download one of the pre-built binaries provided for your platform from the artifacts attached to this release.

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/getsops/sops/releases/download/v3.13.2/sops-v3.13.2.linux.amd64
Move the binary in to your PATH
mv sops-v3.13.2.linux.amd64 /usr/local/bin/sops
Make the binary executable
chmod +x /usr/local/bin/sops

Verify checksums file signature

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/getsops/sops/releases/download/v3.13.2/sops-v3.13.2.checksums.txt
curl -LO https://github.com/getsops/sops/releases/download/v3.13.2/sops-v3.13.2.checksums.sigstore.json
Verify the checksums file
cosign verify-blob sops-v3.13.2.checksums.txt 
--bundle sops-v3.13.2.checksums.sigstore.json 
--certificate-identity-regexp=https://github.com/getsops 
--certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature:

# Verify the binary using the checksums file
sha256sum -c sops-v3.13.2.checksums.txt --ignore-missing

Verify artifact provenance

The SLSA provenance of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an in-toto link metadata file named sops-v3.13.2.intoto.jsonl. To verify the provenance of an artifact, you can utilize the slsa-verifier tool:

# Download the metadata file
curl -LO  https://github.com/getsops/sops/releases/download/v3.13.2/sops-v3.13.2.intoto.jsonl
</tr></table> 

... (truncated)

Changelog

Sourced from github.com/getsops/sops/v3's changelog.

3.13.2

Improvements:

• Dependency updates (#2185), (#2193), (#2197), (#2212), (#2218), (#2229), (#2231), (#2231).
• Fix typos in documentation (#2221).

Bugfixes:

• When using --user in the sops exec-file and sops exec-env subcommands, supplementary groups are now reset to the ones of the supplied user (#2194).
• When using --user in the sops exec-file and sops exec-env subcommands, make sure that HOME, USER, and LOGNAME are set to the correct values for the supplied user (#2230).
• AWS KMS: Handle pointers when serializing AWS context (#2219).
• JSON store: Preverse large integers that fit into int64 (#2222).
• INI store: Restore old behavior of double-escaping newlines in metadata, and adjust code to handle both the 3.13.0/3.13.1 single-escaped newlines as well as double-escaped newlines (#2189).
• Fix panic when expecting a string for encrypted data, but when encountering something else (#2227).

Project changes:

• CI dependency updates (#2184), (#2192), (#2196), (#2211), (#2228), (#2236).
• Rust dependency updates for functional tests (#2191).
• Build alpine container in CI (#2217).
• Improve make test by unsetting all age environment variables (#2208).
• Shorten lines in MarkDown files (#2206).

Commits

• 15e36f9 Merge pull request #2232 from felixfontein/release-3.13.2
• 0d49dff Add changelog for 3.13.2.
• 72d9f5a Bump version to 3.13.2.
• 8a62945 Merge pull request #2236 from getsops/dependabot/github_actions/ci-35246068e4
• 59d36c6 build(deps): Bump the ci group with 2 updates
• ed14c0b Merge pull request #2233 from getsops/dependabot/go_modules/github.com/openco...
• ff43b27 build(deps): Bump github.com/opencontainers/runc from 1.2.8 to 1.3.6
• 1c13f06 Merge pull request #2231 from felixfontein/deps
• 818f7d9 Update all dependencies.
• bb4f688 Merge pull request #2206 from felixfontein/mdl2
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.53.0 to 0.54.0

Commits

• cdce021 go.mod: update golang.org/x dependencies
• d9474cc openpgp: make the deprecation message more explicit
• 7626c50 ssh: verify declared key type matches decoded key in authorized_keys
• 0471e79 ssh/agent: enforce strict limits on DSA key parameters
• 6435c37 ssh: sanitize client disconnect messages
• 7d695da ssh/agent: drain channel stderr in agent forwarders
• 5b7f841 acme/autocert: fix data race in Manager.createCert
• 0b316e7 argon2: update RFC 9106 parameter recommendations
• 55aec0a x509roots/fallback: update bundle
• 5f2de1a internal: remove wycheproof tests
• See full diff in compare view

Updates golang.org/x/net from 0.55.0 to 0.56.0

Commits

• 9e7fdbf internal/http3: fix wrong argument being given when validating header value
• b686e5f internal/http3: add gzip support to transport
• 8a34885 go.mod: update golang.org/x dependencies
• 72eaf98 dns/dnsmessage: correctly validate SVCB record parameter order
• 82e7868 dns/dnsmessage: avoid panic when parsing SVCB record with truncated data
• b64f1fa internal/http3: add server support for "Trailer:" magic prefix
• 2707ee2 internal/http3: implement HTTP/3 clientConn methods
• 31358cc internal/http3: snapshot response headers at WriteHeader time
• 8ecbaa9 html: don't adjust xml:base
• 8ae811a html: properly handle end script tag in fragment mode
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.21.0 to 0.22.0

Commits

• 1eb64d4 semaphore: panic on negative weights
• See full diff in compare view

Updates golang.org/x/text from 0.38.0 to 0.40.0

Commits

• 724af9c go.mod: update golang.org/x dependencies
• bf5b9d6 internal/export/idna: always treat Punycode encoding pure ASCII as an error
• b326f3d go.mod: update golang.org/x dependencies
• 5ae8e57 unicode/norm: avoid infinite loop on invalid input
• 0dc94a2 all: fix some comments
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!