chore(deps): update go modules

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/hashicorp/hcl/v2	v2.21.0 -> v2.22.0
github.com/migueleliasweb/go-github-mock	v1.0.0 -> v1.0.1
github.com/open-policy-agent/opa	v0.67.1 -> v0.68.0
golang.org/x/oauth2	v0.22.0 -> v0.23.0
golang.org/x/text	v0.17.0 -> v0.18.0
google.golang.org/api	v0.193.0 -> v0.196.0

---

Release Notes

hashicorp/hcl (github.com/hashicorp/hcl/v2)

v2.22.0

Compare Source

Enhancements

• feat: return an ExprSyntaxError for invalid references that end in a dot (#​692)

migueleliasweb/go-github-mock (github.com/migueleliasweb/go-github-mock)

v1.0.1

Compare Source

What's Changed

• Update to latest GitHub library by @​mlschechter in https://github.com/migueleliasweb/go-github-mock/pull/72
• Update GH definitions by @​migueleliasweb in https://github.com/migueleliasweb/go-github-mock/pull/73

New Contributors

• @​mlschechter made their first contribution in https://github.com/migueleliasweb/go-github-mock/pull/72

Full Changelog: migueleliasweb/go-github-mock@v1.0.0...v1.0.1

open-policy-agent/opa (github.com/open-policy-agent/opa)

v0.68.0

Compare Source

This release contains a mix of features and bugfixes.

Breaking Changes

entrypoint annotation implies document scope (#​6798)

The entrypoint annotation's scope requirement has changed from rule to document (https://github.com/open-policy-agent/opa/issues/6798). Furthermore, if no scope annotation is declared for a METADATA block preceding a rule, the presence of an entrypoint annotation with a true value will assign the block a document scope, where the rule scope is otherwise the default.

In practice, a rule entrypoint always point to the entire document and not a particular rule definition. The previous behavior was a bug, and one we've now addressed.

Authored by @​anderseknert

Topdown and Rego

• ast: Fixing nil-pointer dereference in compiler for partial rule edge case (#​6930) authored by @​johanfylling
• ast+parser: Add hint to future-proof imports (6968) authored by @​srenatus
• topdown: Adding unification scope to virtual-cache key. Fixing issue where false positive cache hits can occur when unification "restricts" the scope of ref-head rule evaluation (#​6926) authored by @​johanfylling reported by @​anderseknert
• topdown: Marshal JWT encode sign inputs as JSON (#​6934) authored by @​charlieegan3

Runtime, Tooling, SDK

• ast: Make type checker copy method copy all values (#​6949) authored by @​anderseknert
• ast: Include term locations in rule heads when requested (#​6860) authored by @​anderseknert
• debug: Adding experimental debugger SDK (#​6876) authored by @​johanfylling
• distributedtracing: allow OpenTelemetry resource attributes to be configured under distributed_tracing config (#​6942) authored and reported by @​brettmc
• download: Fixing issue when saving OCI bundles on disk (#​6939) authored and reported by @​Sergey-Kizimov
• logging: Always include HTTP request context in incoming req context (#​6951) authored by @​ashutosh-narkar reported by @​alvarogomez93
• plugins/bundle: Avoid race-condition during bundle reconfiguration and activation (#​6849) authored by @​ashutosh-narkar reported by @​Pushpalanka
• plugins/bundle: Escape reserved chars used in persisted bundle directory name (#​6915) authored by @​ashutosh-narkar reported by @​alvarogomez93
• plugins/rest: Support AWS_CONTAINER_CREDENTIALS_FULL_URI metadata endpoint (#​6893) authored and reported by @​mbamber
• util+server: Fix bug around chunked request handling. (#​6904) authored by @​philipaconrad reported by @​David-Wobrock
• opa exec: This command never supported "pretty" formatting (--format=pretty or -f pretty), only json. Passing pretty is now invalid. (#​6923) authored by @​srenatus
  Note that the flag is now unnecessary, but it's kept so existing calls like opa exec -fjson ... remain valid.

Security Fix: CVE-2024-8260 (#​6933)

This release includes a fix where OPA would accept UNC locations on Windows. Reading those could leak NTLM hashes.
The attack vector would include an adversary tricking the user in passing an UNC path to OPA, e.g. opa eval -d $FILE.
UNC paths are now forbidden. If this is an issue for you, please reach out on Slack or GitHub issues.

Reported by Shelly Raban
Authored by @​ashutosh-narkar

Docs, Website, Ecosystem

• docs: Suggest using opa-config.yaml as name for config file (#​6966) (#​6959) authored by @​anderseknert
• docs: Add documentation for OPA Spring Boot integration (#​6898) authored by @​charlieegan3
• docs: Update Istio tutorial (#​6896) authored by @​Pindar
• docs: Update contrib docs (#​6974) authored by @​charlieegan3
• docs: Add Lula to the OPA ecosystem (#​6902) authored by @​brandtkeller
• docs: Add github action policy testing automation (#​6954) authored by @​oycyc
• docs: Mention http.send in inter-query cache config docs (#​6953) authored by @​anderseknert
• docs+topdown: Fixing typos in built-in descriptions (#​6940) authored by @​msorens

Miscellaneous

• build: Make it possible to build only wasm testcases (#​6920) authored by @​andreaTP
• Dependency updates; notably:
  • build(deps): bump github.com/containerd/containerd from 1.7.20 to 1.7.21
  • build(deps): bump github.com/prometheus/client_golang from 1.19.1 to 1.20.2
  • build(deps): bump golang.org/x/net from 0.27.0 to 0.28.0
  • build(deps): bump golang.org/x/time from 0.5.0 to 0.6.0
  • build(deps): bump google.golang.org/grpc from 1.65.0 to 1.66.0

googleapis/google-api-go-client (google.golang.org/api)

v0.196.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​2760) (21f10ed)
• all: Auto-regenerate discovery clients (#​2763) (293fdcd)
• all: Auto-regenerate discovery clients (#​2764) (d9ef5ce)
• all: Auto-regenerate discovery clients (#​2765) (6e81c8f)
• all: Auto-regenerate discovery clients (#​2768) (00da46b)

v0.195.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​2750) (6bdae51)
• all: Auto-regenerate discovery clients (#​2752) (5b1ebe2)
• all: Auto-regenerate discovery clients (#​2753) (70a68c2)
• all: Auto-regenerate discovery clients (#​2755) (3f3bd66)
• all: Auto-regenerate discovery clients (#​2756) (e907e01)
• all: Auto-regenerate discovery clients (#​2759) (04cbad8)

v0.194.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​2746) (5d61f08)

Bug Fixes

• gen: Change HttpBody.Data from string to any for monitoring:v1 (#​2744) (eda6a59), refs #​2304

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ Artifact update notice

File name: cli/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 19 additional dependencies were updated

Details:

Package	Change
cloud.google.com/go/accesscontextmanager	v1.8.12 -> v1.9.0
cloud.google.com/go/auth	v0.9.0 -> v0.9.3
cloud.google.com/go/iam	v1.1.13 -> v1.2.0
cloud.google.com/go/longrunning	v0.5.12 -> v0.6.0
cloud.google.com/go/orgpolicy	v1.12.8 -> v1.13.0
cloud.google.com/go/osconfig	v1.13.3 -> v1.14.0
github.com/googleapis/enterprise-certificate-proxy	v0.3.2 -> v0.3.3
github.com/prometheus/client_golang	v1.19.1 -> v1.20.2
github.com/prometheus/common	v0.48.0 -> v0.55.0
github.com/prometheus/procfs	v0.12.0 -> v0.15.1
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	v0.52.0 -> v0.54.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.53.0 -> v0.54.0
go.opentelemetry.io/otel	v1.28.0 -> v1.29.0
go.opentelemetry.io/otel/metric	v1.28.0 -> v1.29.0
go.opentelemetry.io/otel/trace	v1.28.0 -> v1.29.0
google.golang.org/genproto	v0.0.0-20240814211410-ddb44dafa142 -> v0.0.0-20240903143218-8af14fe29dc1
google.golang.org/genproto/googleapis/api	v0.0.0-20240814211410-ddb44dafa142 -> v0.0.0-20240827150818-7e3bb234dfed
google.golang.org/genproto/googleapis/rpc	v0.0.0-20240814211410-ddb44dafa142 -> v0.0.0-20240903143218-8af14fe29dc1
google.golang.org/grpc	v1.65.0 -> v1.66.0

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[forking-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[dpebot]

/gcbrun