Bump the backend group with 4 updates

[dependabot]

Bumps the backend group with 4 updates: github.com/aquasecurity/trivy, github.com/open-policy-agent/opa, golang.org/x/crypto and golang.org/x/text.

Updates github.com/aquasecurity/trivy from 0.55.2 to 0.56.1

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.56.1

Changelog

• 95dbf1152b2049a6ae2ae90a507630df01798bf1 release: v0.56.1 [release/v0.56] (#7648)
• 5dbdadfe4578288d5c3f2a5b625fff4a3580f8c5 fix(db): fix javadb downloading error handling [backport: release/v0.56] (#7646)

v0.56.0

⚡Release highlights and summary⚡

👉aquasecurity/trivy#7640

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0560-2024-10-03

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.56.1 (2024-10-03)

Bug Fixes

• db: fix javadb downloading error handling [backport: release/v0.56] (#7646) (5dbdadf)

0.56.0 (2024-10-03)

Features

• java: add empty versions if pom.xml dependency versions can't be detected (#7520) (b836232)
• license: improve license normalization (#7131) (6472e3c)
• misconf: add ability to disable checks by ID (#7536) (ef0a27d)
• misconf: Register checks only when needed (#7435) (f768d3a)
• misconf: Support --skip-* for all included modules (#7579) (c0e8da3)
• secret: enhance secret scanning for python binary files (#7223) (60725f8)
• support multiple DB repositories for vulnerability and Java DB (#7605) (3562529)
• support RPM archives (#7628) (69bf7e0)
• suse: added SUSE Linux Enterprise Micro support (#7294) (efdb68d)

Bug Fixes

• allow access to '..' in mapfs (#7575) (a8fbe46)
• db: check DownloadedAt for trivy-java-db (#7592) (13ef3e7)
• java: use dependencyManagement from root/child pom's for dependencies from parents (#7497) (5442949)
• license: stop spliting a long license text (#7336) (4926da7)
• misconf: Disable deprecated checks by default (#7632) (82e2adc)
• misconf: disable DS016 check for image history analyzer (#7540) (de40df9)
• misconf: escape all special sequences (#7558) (ea0cf03)
• misconf: Fix logging typo (#7473) (56db43c)
• misconf: Fixed scope for China Cloud (#7560) (37d549e)
• misconf: not to warn about missing selectors of libraries (#7638) (fcaea74)
• oracle: Update EOL date for Oracle 7 (#7480) (dd0a64a)
• report: change a receiver of MarshalJSON (#7483) (927c6e0)
• report: fix error with unmarshal of ExperimentalModifiedFindings (#7463) (7ff9aff)
• sbom: export bom-ref when converting a package to a component (#7340) (5dd94eb)
• sbom: parse type framework as library when unmarshalling CycloneDX files (#7527) (aeb7039)
• secret: change grafana token regex to find them without unquoted (#7627) (3e1fa21)

Performance Improvements

• misconf: use port ranges instead of enumeration (#7549) (1f9fc13)

Reverts

... (truncated)

Commits

• 95dbf11 release: v0.56.1 [release/v0.56] (#7648)
• 5dbdadf fix(db): fix javadb downloading error handling [backport: release/v0.56] (#7646)
• d246401 release: v0.56.0 [main] (#7447)
• fcaea74 fix(misconf): not to warn about missing selectors of libraries (#7638)
• 69bf7e0 feat: support RPM archives (#7628)
• 3e1fa21 fix(secret): change grafana token regex to find them without unquoted (#7627)
• 8735242 chore(deps): Bump trivy-checks to v1.1.0 (#7631)
• 82e2adc fix(misconf): Disable deprecated checks by default (#7632)
• 1faf529 chore: add prefixes to log messages (#7625)
• c0e8da3 feat(misconf): Support --skip-* for all included modules (#7579)
• Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa from 0.68.0 to 0.68.1-0.20240903211041-76f7038ea2d1

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

Change Log

All notable changes to this project will be documented in this file. This project adheres to Semantic Versioning.

Unreleased

0.69.0

This release contains a mix of features, bugfixes and necessary tooling and test changes required to support the upcoming OPA 1.0 release.

Inter-Query Value Cache (#6908)

OPA now has a new inter-query value cache added to the SDK. It is intended to be used for values that are expensive to compute and can be reused across multiple queries. The cache can be leveraged by built-in functions to store values that otherwise aren't appropriate for the existing inter-query cache; for instance when the entry size isn't an appropriate or primary limiting factor for cache eviction.

The default size of the inter-query value cache is unbounded, but can be configured via the caching.inter_query_builtin_value_cache.max_num_entries configuration field. OPA will drop random items from the cache if this limit is exceeded.

The cache is used by the regex and glob built-in functions, which previously had individual, non-configurable caches with a max entry size of 100 each.

Currently, the cache is only exercised when running OPA in server mode (ie. opa run -s). Also this feature is unsupported for WASM.

Authored by @​ashutosh-narkar, reported by @​amirsalarsafaei

Topdown and Rego

• Future-proofing tests in the ast, topdown, rego etc. packages to be 1.0 compatible (authored by @​johanfylling)
• ast: Attach annotation to static part of rule ref (#7050) authored by @​anderseknert
• ast: Make Module.String() include if/contains for v1 modules (#6973) authored by @​johanfylling reported by @​nikpivkin
• topdown/http: Stop http.send latency timer when an error is encountered (#7007) authored by @​lukyer
• ast/compile: Refactor local variable replacement and replace declared variables in with's target (#6979) authored by @​srenatus reported by @​bluebrown
• ast: Update type checker to cache schema types (#6970) authored by @​nikpivkin
• test: Fix indentation in a YAML test case (#7039) authored by @​matajoh
• format: Bracketing keyword ref elements in formatter output (#7010) authored by @​johanfylling

Runtime, Tooling, SDK

• Future-proofing tests in the sdk, downlaod, server , cmd etc. packages to be 1.0 compatible (authored by @​johanfylling)
• cmd: Add --v0-compatible flag to make OPA behave as v0.x post v1.0 release (#7065) authored by @​johanfylling
• util: Strip UTF-8 BOM from input JSON when found (#6988) authored by @​anderseknert reported by @​adhilto
• plugins/rest: Support reading AWS token from the filesystem for the AWS container credential provider (#6997) authored by @​cmaddalozzo
• debug: Add RegoOption launch option to debugger for setting custom Rego options (#7045) authored by @​johanfylling
• debug: Always include Input and Data variable scopes to ease discoverability of the scopes (#7074) authored by @​johanfylling

... (truncated)

Commits

• See full diff in compare view

Updates golang.org/x/crypto from 0.27.0 to 0.28.0

Commits

• adef4cc go.mod: update golang.org/x dependencies
• a0819fb sha3: fix cSHAKE initialization for extremely large N and or S
• 42ee18b ssh: return ServerAuthError after too many auth failures
• 9e92970 bn256: add missing symbols in comment
• See full diff in compare view

Updates golang.org/x/text from 0.18.0 to 0.19.0

Commits

• 3043346 x/text: Correct examples in number/doc
• 38a95c2 all: fix some comments
• 20097e4 all: fix printf(var) mistakes detected by latest printf checker
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml