build(deps): bump the security group across 1 directory with 5 updates

[dependabot]

Bumps the security group with 4 updates in the / directory: github.com/aws/aws-sdk-go-v2, github.com/aws/aws-sdk-go-v2/config, github.com/containers/image/v5 and github.com/vmware-tanzu/velero.

Updates github.com/aws/aws-sdk-go-v2 from 1.30.3 to 1.30.5

Commits

• a2b751d Release 2024-09-03
• e22c249 Regenerated Clients
• ff0cf6f Update API model
• 3120376 refactoring of buildQuery to accept a list of maintained headers to l… (#2773)
• 4ed838e Merge pull request #2768 from bhavya2109sharma/presignedurl-requestpayer-change
• d4bd42f Merge branch 'main' into presignedurl-requestpayer-change
• 0353706 Added Changelog
• 97e2d3f Release 2024-08-30
• 4cca52b Regenerated Clients
• c8a5146 Update endpoints model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.27.27 to 1.27.32

Commits

• a2b751d Release 2024-09-03
• e22c249 Regenerated Clients
• ff0cf6f Update API model
• 3120376 refactoring of buildQuery to accept a list of maintained headers to l… (#2773)
• 4ed838e Merge pull request #2768 from bhavya2109sharma/presignedurl-requestpayer-change
• d4bd42f Merge branch 'main' into presignedurl-requestpayer-change
• 0353706 Added Changelog
• 97e2d3f Release 2024-08-30
• 4cca52b Regenerated Clients
• c8a5146 Update endpoints model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.17.27 to 1.17.31

Commits

• a2b751d Release 2024-09-03
• e22c249 Regenerated Clients
• ff0cf6f Update API model
• 3120376 refactoring of buildQuery to accept a list of maintained headers to l… (#2773)
• 4ed838e Merge pull request #2768 from bhavya2109sharma/presignedurl-requestpayer-change
• d4bd42f Merge branch 'main' into presignedurl-requestpayer-change
• 0353706 Added Changelog
• 97e2d3f Release 2024-08-30
• 4cca52b Regenerated Clients
• c8a5146 Update endpoints model
• Additional commits viewable in compare view

Updates github.com/containers/image/v5 from 5.32.1 to 5.32.2

Release notes

Sourced from github.com/containers/image/v5's releases.

v5.32.2

This adds the ability to accept sigstore signatures signed by any key from a set of several (huge thanks to @​dcermak and @​danishprakash for doing almost all the work), and Rekor log presence proofs signed by any key from a set of several keys.

Commits

• 0b425a4 Release 5.32.2
• 2a87b21 Support accepting multiple Rekor public keys
• 95c0635 Add field KeyPaths and KeyDatas to prSigstoreSigned
• d42de59 Split verifySigstorePayloadBlobSignature from VerifySigstorePayload
• a5ea016 Use loadBytesFromConfigSources in prSignedBy.isSignatureAuthorAccepted
• 03550b4 Turn loadBytesFromDataOrPath into loadBytesFromConfigSources
• c0c8d34 Use InvalidPolicyFormatError for invalid sigstore options
• 4bcaca1 Merge pull request #2511 from mtrmac/5.32-version
• c94eadb Fix the version number
• 6a17c28 Merge pull request #2508 from mtrmac/5.32-zstd
• Additional commits viewable in compare view

Updates github.com/vmware-tanzu/velero from 1.14.0 to 1.14.1

Release notes

Sourced from github.com/vmware-tanzu/velero's releases.

v1.14.1

Download

https://github.com/vmware-tanzu/velero/releases/tag/v1.14.1

Container Image

velero/velero:v1.14.1

Documentation

https://velero.io/docs/v1.14/

Upgrading

https://velero.io/docs/v1.14/upgrade-to-1.14/

All Changes

• Avoid wrapping failed PVB status with empty message. (#8037, @​mrnold)
• Make PVPatchMaximumDuration timeout configurable (#8035, @​shubham-pampattiwar)
• Reuse existing plugin manager for get/put volume info (#8016, @​sseago)
• Skip PV patch step in Restoe workflow for WaitForFirstConsumer VolumeBindingMode Pending state PVCs (#8006, @​shubham-pampattiwar)
• Check whether the namespaces specified in namespace filter exist. (#7998, @​blackpiglet)
• Check whether the volume's source is PVC before fetching its PV. (#7976, @​blackpiglet)
• Fix issue #7904, add the limitation clarification for change PVC selected-node feature (#7949, @​Lyndon-Li)
• Expose the VolumeHelper to third-party plugins. (#7944, @​blackpiglet)
• Don't consider unschedulable pods unrecoverable (#7926, @​sseago)

v1.14.1-rc.1

v1.14.1

Download

https://github.com/vmware-tanzu/velero/releases/tag/v1.14.1-rc.1

Container Image

velero/velero:v1.14.1-rc.1

Documentation

https://velero.io/docs/v1.14/

Upgrading

https://velero.io/docs/v1.14/upgrade-to-1.14/

All Changes

• Avoid wrapping failed PVB status with empty message. (#8037, @​mrnold)
• Make PVPatchMaximumDuration timeout configurable (#8035, @​shubham-pampattiwar)
• Reuse existing plugin manager for get/put volume info (#8016, @​sseago)
• Skip PV patch step in Restoe workflow for WaitForFirstConsumer VolumeBindingMode Pending state PVCs (#8006, @​shubham-pampattiwar)
• Check whether the namespaces specified in namespace filter exist. (#7998, @​blackpiglet)
• Check whether the volume's source is PVC before fetching its PV. (#7976, @​blackpiglet)
• Fix issue #7904, add the limitation clarification for change PVC selected-node feature (#7949, @​Lyndon-Li)
• Expose the VolumeHelper to third-party plugins. (#7944, @​blackpiglet)
• Don't consider unschedulable pods unrecoverable (#7926, @​sseago)

Commits

• 8afe3ce Merge pull request #8124 from Lyndon-Li/release-1.14
• 6ae1582 change log for 1.14.1
• 69d950e Merge pull request #8118 from blackpiglet/fix_cve_for_1.14
• fb146cd Bump base image and golang version to fix CVEs.
• cd601ca Merge pull request #8037 from mrnold/pod-volume-message-7857-1.14
• 76a3ecc Add changelog file.
• 3dde086 Avoid wrapping failed PVB status with empty message.
• ebafe12 Merge pull request #8035 from shubham-pampattiwar/expose-pv-patch-max-timeout...
• fea6316 Expose PVPatchMaximumDuration timeout for custom configuration
• 6ae34a1 Merge pull request #8016 from sseago/plugin-leak-1.14
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once CI passes on it, as requested by @laverya.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[laverya]

@dependabot merge

[github-actions]

This PR has been released (on staging) and is available for download with a embedded-cluster-smoke-test-staging-app license ID.

Online Installer:

curl "https://staging.replicated.app/embedded/embedded-cluster-smoke-test-staging-app/ci/appver-dev-049b8b1" -H "Authorization: $EC_SMOKE_TEST_LICENSE_ID" -o embedded-cluster-smoke-test-staging-app-ci.tgz

Airgap Installer (may take a few minutes before the airgap bundle is built):

curl "https://staging.replicated.app/embedded/embedded-cluster-smoke-test-staging-app/ci-airgap/appver-dev-049b8b1?airgap=true" -H "Authorization: $EC_SMOKE_TEST_LICENSE_ID" -o embedded-cluster-smoke-test-staging-app-ci.tgz

Happy debugging!

[dependabot]

One of your CI runs failed on this pull request, so Dependabot won't merge it.

Dependabot will still automatically merge this pull request if you amend it and your tests pass.

[laverya]

@dependabot merge