Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package nfpm for openSUSE:Factory checked in
at 2024-09-16 17:42:03
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/nfpm (Old)
and /work/SRC/openSUSE:Factory/.nfpm.new.29891 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "nfpm"
Mon Sep 16 17:42:03 2024 rev:4 rq:1201176 version:2.40.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/nfpm/nfpm.changes 2024-08-17
12:42:09.965811361 +0200
+++ /work/SRC/openSUSE:Factory/.nfpm.new.29891/nfpm.changes 2024-09-16
17:43:04.977074721 +0200
@@ -1,0 +2,12 @@
+Sat Sep 14 16:25:54 UTC 2024 - opensuse_buildserv...@ojkastl.de
+
+- Update to version 2.40.0:
+ * feat(deps): bump github.com/Masterminds/semver/v3 from 3.2.1 to
+ 3.3.0 (#852)
+ * chore(deps): bump anchore/sbom-action from 0.17.1 to 0.17.2
+ (#851)
+ * feat(deps): bump dario.cat/mergo from 1.0.0 to 1.0.1 (#850)
+ * feat(deb): set license field (#849)
+ * docs: update cmd docs
+
+-------------------------------------------------------------------
Old:
----
nfpm-2.39.0.obscpio
New:
----
nfpm-2.40.0.obscpio
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ nfpm.spec ++++++
--- /var/tmp/diff_new_pack.t29Gku/_old 2024-09-16 17:43:06.665144500 +0200
+++ /var/tmp/diff_new_pack.t29Gku/_new 2024-09-16 17:43:06.673144831 +0200
@@ -19,7 +19,7 @@
%define __arch_install_post export NO_BRP_STRIP_DEBUG=true
Name: nfpm
-Version: 2.39.0
+Version: 2.40.0
Release: 0
Summary: Simple deb, rpm, apk and arch linux packager written in Go
License: MIT
++++++ _service ++++++
--- /var/tmp/diff_new_pack.t29Gku/_old 2024-09-16 17:43:07.021159216 +0200
+++ /var/tmp/diff_new_pack.t29Gku/_new 2024-09-16 17:43:07.065161035 +0200
@@ -3,19 +3,21 @@
<param name="url">https://github.com/goreleaser/nfpm</param>
<param name="scm">git</param>
<param name="exclude">.git</param>
- <param name="revision">v2.39.0</param>
+ <param name="revision">v2.40.0</param>
<param name="versionformat">@PARENT_TAG@</param>
<param name="changesgenerate">enable</param>
<param name="versionrewrite-pattern">v(.*)</param>
</service>
<service name="set_version" mode="manual">
</service>
- <service name="tar" mode="buildtime"/>
+ <service name="go_modules" mode="manual">
+ </service>
+ <!-- services below are running at buildtime -->
+ <service name="tar" mode="buildtime">
+ </service>
<service name="recompress" mode="buildtime">
<param name="file">*.tar</param>
<param name="compression">gz</param>
</service>
- <service name="go_modules" mode="manual">
- </service>
</services>
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.t29Gku/_old 2024-09-16 17:43:07.269169468 +0200
+++ /var/tmp/diff_new_pack.t29Gku/_new 2024-09-16 17:43:07.301170791 +0200
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param name="url">https://github.com/goreleaser/nfpm</param>
- <param
name="changesrevision">abdde689ee5b84b2b0ac5ae58495b723a719d06a</param></service></servicedata>
+ <param
name="changesrevision">db338d012a43be3c7f9c5a450eca2e279c973de4</param></service></servicedata>
(No newline at EOF)
++++++ nfpm-2.39.0.obscpio -> nfpm-2.40.0.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nfpm-2.39.0/.github/workflows/release.yml
new/nfpm-2.40.0/.github/workflows/release.yml
--- old/nfpm-2.39.0/.github/workflows/release.yml 2024-08-15
03:45:12.000000000 +0200
+++ new/nfpm-2.40.0/.github/workflows/release.yml 2024-08-29
13:36:48.000000000 +0200
@@ -35,7 +35,7 @@
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
- uses: sigstore/cosign-installer@v3.6.0
- - uses: anchore/sbom-action/download-syft@v0.17.1
+ - uses: anchore/sbom-action/download-syft@v0.17.2
- uses: docker/setup-qemu-action@v3
- uses: docker/setup-buildx-action@v3
- uses: cachix/install-nix-action@V27
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nfpm-2.39.0/deb/deb.go new/nfpm-2.40.0/deb/deb.go
--- old/nfpm-2.39.0/deb/deb.go 2024-08-15 03:45:12.000000000 +0200
+++ new/nfpm-2.40.0/deb/deb.go 2024-08-29 13:36:48.000000000 +0200
@@ -724,6 +724,9 @@
Priority: {{.Info.Priority}}
Architecture: {{ if ne .Info.Platform "linux"}}{{ .Info.Platform }}-{{ end
}}{{.Info.Arch}}
{{- /* Optional fields */ -}}
+{{- if .Info.License }}
+License: {{.Info.License}}
+{{- end }}
{{- if .Info.Maintainer}}
Maintainer: {{.Info.Maintainer}}
{{- end }}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nfpm-2.39.0/deb/deb_test.go
new/nfpm-2.40.0/deb/deb_test.go
--- old/nfpm-2.39.0/deb/deb_test.go 2024-08-15 03:45:12.000000000 +0200
+++ new/nfpm-2.40.0/deb/deb_test.go 2024-08-29 13:36:48.000000000 +0200
@@ -46,6 +46,7 @@
Section: "default",
Homepage: "http://carlosbecker.com";,
Vendor: "nope",
+ License: "MIT",
Overridables: nfpm.Overridables{
Depends: []string{
"bash",
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nfpm-2.39.0/deb/testdata/bad_provides.golden
new/nfpm-2.40.0/deb/testdata/bad_provides.golden
--- old/nfpm-2.39.0/deb/testdata/bad_provides.golden 2024-08-15
03:45:12.000000000 +0200
+++ new/nfpm-2.40.0/deb/testdata/bad_provides.golden 2024-08-29
13:36:48.000000000 +0200
@@ -3,6 +3,7 @@
Section: default
Priority: extra
Architecture: amd64
+License: MIT
Maintainer: Carlos A Becker <p...@carlosbecker.com>
Installed-Size: 0
Replaces: svn
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nfpm-2.39.0/deb/testdata/control.golden
new/nfpm-2.40.0/deb/testdata/control.golden
--- old/nfpm-2.39.0/deb/testdata/control.golden 2024-08-15 03:45:12.000000000
+0200
+++ new/nfpm-2.40.0/deb/testdata/control.golden 2024-08-29 13:36:48.000000000
+0200
@@ -3,6 +3,7 @@
Section: default
Priority: extra
Architecture: amd64
+License: MIT
Maintainer: Carlos A Becker <p...@carlosbecker.com>
Installed-Size: 10
Replaces: svn
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nfpm-2.39.0/go.mod new/nfpm-2.40.0/go.mod
--- old/nfpm-2.39.0/go.mod 2024-08-15 03:45:12.000000000 +0200
+++ new/nfpm-2.40.0/go.mod 2024-08-29 13:36:48.000000000 +0200
@@ -3,9 +3,9 @@
go 1.21
require (
- dario.cat/mergo v1.0.0
+ dario.cat/mergo v1.0.1
github.com/AlekSi/pointer v1.2.0
- github.com/Masterminds/semver/v3 v3.2.1
+ github.com/Masterminds/semver/v3 v3.3.0
github.com/ProtonMail/go-crypto v1.0.0
github.com/ProtonMail/gopenpgp/v2 v2.7.1
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nfpm-2.39.0/go.sum new/nfpm-2.40.0/go.sum
--- old/nfpm-2.39.0/go.sum 2024-08-15 03:45:12.000000000 +0200
+++ new/nfpm-2.40.0/go.sum 2024-08-29 13:36:48.000000000 +0200
@@ -1,5 +1,5 @@
-dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
-dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
+dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
github.com/AlekSi/pointer v1.2.0
h1:glcy/gc4h8HnG2Z3ZECSzZ1IX1x2JxRVuDzaJwQE0+w=
github.com/AlekSi/pointer v1.2.0/go.mod
h1:gZGfd3dpW4vEc/UlyfKKi1roIqcCgwOIvb0tSNSBle0=
github.com/DataDog/zstd v1.5.5 h1:oWf5W7GtOLgp6bciQYDmhHHjdhYkALu6S/5Ni9ZgSvQ=
@@ -7,8 +7,8 @@
github.com/Masterminds/goutils v1.1.1
h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
github.com/Masterminds/goutils v1.1.1/go.mod
h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
github.com/Masterminds/semver/v3 v3.2.0/go.mod
h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
-github.com/Masterminds/semver/v3 v3.2.1
h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
-github.com/Masterminds/semver/v3 v3.2.1/go.mod
h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.3.0
h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
+github.com/Masterminds/semver/v3 v3.3.0/go.mod
h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
github.com/Masterminds/sprig/v3 v3.2.3
h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
github.com/Masterminds/sprig/v3 v3.2.3/go.mod
h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
github.com/Microsoft/go-winio v0.5.2/go.mod
h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nfpm-2.39.0/www/docs/static/latest
new/nfpm-2.40.0/www/docs/static/latest
--- old/nfpm-2.39.0/www/docs/static/latest 2024-08-15 03:45:12.000000000
+0200
+++ new/nfpm-2.40.0/www/docs/static/latest 2024-08-29 13:36:48.000000000
+0200
@@ -1 +1 @@
-v2.38.0
+v2.39.0
++++++ nfpm.obsinfo ++++++
--- /var/tmp/diff_new_pack.t29Gku/_old 2024-09-16 17:43:07.613183689 +0200
+++ /var/tmp/diff_new_pack.t29Gku/_new 2024-09-16 17:43:07.617183854 +0200
@@ -1,5 +1,5 @@
name: nfpm
-version: 2.39.0
-mtime: 1723686312
-commit: abdde689ee5b84b2b0ac5ae58495b723a719d06a
+version: 2.40.0
+mtime: 1724931408
+commit: db338d012a43be3c7f9c5a450eca2e279c973de4
++++++ vendor.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/vendor/dario.cat/mergo/.gitignore
new/vendor/dario.cat/mergo/.gitignore
--- old/vendor/dario.cat/mergo/.gitignore 2024-08-16 20:11:16.000000000
+0200
+++ new/vendor/dario.cat/mergo/.gitignore 2024-09-14 18:25:59.000000000
+0200
@@ -13,6 +13,9 @@
# Output of the go coverage tool, specifically when used with LiteIDE
*.out
+# Golang/Intellij
+.idea
+
# Project-local glide cache, RE:
https://github.com/Masterminds/glide/issues/736
.glide/
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/vendor/dario.cat/mergo/README.md
new/vendor/dario.cat/mergo/README.md
--- old/vendor/dario.cat/mergo/README.md 2024-08-16 20:11:16.000000000
+0200
+++ new/vendor/dario.cat/mergo/README.md 2024-09-14 18:25:59.000000000
+0200
@@ -44,13 +44,21 @@
## Status
-It is ready for production use. [It is used in several projects by Docker,
Google, The Linux Foundation, VMWare, Shopify, Microsoft,
etc](https://github.com/imdario/mergo#mergo-in-the-wild).
+Mergo is stable and frozen, ready for production. Check a short list of the
projects using at large scale it
[here](https://github.com/imdario/mergo#mergo-in-the-wild).
+
+No new features are accepted. They will be considered for a future v2 that
improves the implementation and fixes bugs for corner cases.
### Important notes
#### 1.0.0
-In [1.0.0](//github.com/imdario/mergo/releases/tag/1.0.0) Mergo moves to a
vanity URL `dario.cat/mergo`.
+In [1.0.0](//github.com/imdario/mergo/releases/tag/1.0.0) Mergo moves to a
vanity URL `dario.cat/mergo`. No more v1 versions will be released.
+
+If the vanity URL is causing issues in your project due to a dependency
pulling Mergo - it isn't a direct dependency in your project - it is
recommended to use
[replace](https://github.com/golang/go/wiki/Modules#when-should-i-use-the-replace-directive)
to pin the version to the last one with the old import URL:
+
+```
+replace github.com/imdario/mergo => github.com/imdario/mergo v0.3.16
+```
#### 0.3.9
@@ -64,55 +72,24 @@
If Mergo is useful to you, consider buying me a coffee, a beer, or making a
monthly donation to allow me to keep building great free software. :heart_eyes:
-<a href='https://ko-fi.com/B0B58839' target='_blank'><img height='36'
style='border:0px;height:36px;'
src='https://az743702.vo.msecnd.net/cdn/kofi1.png?v=0' border='0' alt='Buy Me a
Coffee at ko-fi.com' /></a>
<a href="https://liberapay.com/dario/donate";><img alt="Donate using Liberapay"
src="https://liberapay.com/assets/widgets/donate.svg";></a>
<a href='https://github.com/sponsors/imdario' target='_blank'><img alt="Become
my sponsor"
src="https://img.shields.io/github/sponsors/imdario?style=for-the-badge"; /></a>
### Mergo in the wild
-- [moby/moby](https://github.com/moby/moby)
-- [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)
-- [vmware/dispatch](https://github.com/vmware/dispatch)
-- [Shopify/themekit](https://github.com/Shopify/themekit)
-- [imdario/zas](https://github.com/imdario/zas)
-- [matcornic/hermes](https://github.com/matcornic/hermes)
-- [OpenBazaar/openbazaar-go](https://github.com/OpenBazaar/openbazaar-go)
-- [kataras/iris](https://github.com/kataras/iris)
-- [michaelsauter/crane](https://github.com/michaelsauter/crane)
-- [go-task/task](https://github.com/go-task/task)
-- [sensu/uchiwa](https://github.com/sensu/uchiwa)
-- [ory/hydra](https://github.com/ory/hydra)
-- [sisatech/vcli](https://github.com/sisatech/vcli)
-- [dairycart/dairycart](https://github.com/dairycart/dairycart)
-- [projectcalico/felix](https://github.com/projectcalico/felix)
-- [resin-os/balena](https://github.com/resin-os/balena)
-- [go-kivik/kivik](https://github.com/go-kivik/kivik)
-- [Telefonica/govice](https://github.com/Telefonica/govice)
-- [supergiant/supergiant](supergiant/supergiant)
-- [SergeyTsalkov/brooce](https://github.com/SergeyTsalkov/brooce)
-- [soniah/dnsmadeeasy](https://github.com/soniah/dnsmadeeasy)
-- [ohsu-comp-bio/funnel](https://github.com/ohsu-comp-bio/funnel)
-- [EagerIO/Stout](https://github.com/EagerIO/Stout)
--
[lynndylanhurley/defsynth-api](https://github.com/lynndylanhurley/defsynth-api)
-- [russross/canvasassignments](https://github.com/russross/canvasassignments)
-- [rdegges/cryptly-api](https://github.com/rdegges/cryptly-api)
-- [casualjim/exeggutor](https://github.com/casualjim/exeggutor)
-- [divshot/gitling](https://github.com/divshot/gitling)
-- [RWJMurphy/gorl](https://github.com/RWJMurphy/gorl)
-- [andrerocker/deploy42](https://github.com/andrerocker/deploy42)
-- [elwinar/rambler](https://github.com/elwinar/rambler)
-- [tmaiaroto/gopartman](https://github.com/tmaiaroto/gopartman)
-- [jfbus/impressionist](https://github.com/jfbus/impressionist)
-- [Jmeyering/zealot](https://github.com/Jmeyering/zealot)
-- [godep-migrator/rigger-host](https://github.com/godep-migrator/rigger-host)
-- [Dronevery/MultiwaySwitch-Go](https://github.com/Dronevery/MultiwaySwitch-Go)
-- [thoas/picfit](https://github.com/thoas/picfit)
--
[mantasmatelis/whooplist-server](https://github.com/mantasmatelis/whooplist-server)
-- [jnuthong/item_search](https://github.com/jnuthong/item_search)
-- [bukalapak/snowboard](https://github.com/bukalapak/snowboard)
-- [containerssh/containerssh](https://github.com/containerssh/containerssh)
-- [goreleaser/goreleaser](https://github.com/goreleaser/goreleaser)
-- [tjpnz/structbot](https://github.com/tjpnz/structbot)
+Mergo is used by
[thousands](https://deps.dev/go/dario.cat%2Fmergo/v1.0.0/dependents)
[of](https://deps.dev/go/github.com%2Fimdario%2Fmergo/v0.3.16/dependents)
[projects](https://deps.dev/go/github.com%2Fimdario%2Fmergo/v0.3.12), including:
+
+* [containerd/containerd](https://github.com/containerd/containerd)
+* [datadog/datadog-agent](https://github.com/datadog/datadog-agent)
+* [docker/cli/](https://github.com/docker/cli/)
+* [goreleaser/goreleaser](https://github.com/goreleaser/goreleaser)
+* [go-micro/go-micro](https://github.com/go-micro/go-micro)
+* [grafana/loki](https://github.com/grafana/loki)
+* [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)
+* [masterminds/sprig](github.com/Masterminds/sprig)
+* [moby/moby](https://github.com/moby/moby)
+* [slackhq/nebula](https://github.com/slackhq/nebula)
+* [volcano-sh/volcano](https://github.com/volcano-sh/volcano)
## Install
@@ -141,6 +118,39 @@
}
```
+If you need to override pointers, so the source pointer's value is assigned to
the destination's pointer, you must use `WithoutDereference`:
+
+```go
+package main
+
+import (
+ "fmt"
+
+ "dario.cat/mergo"
+)
+
+type Foo struct {
+ A *string
+ B int64
+}
+
+func main() {
+ first := "first"
+ second := "second"
+ src := Foo{
+ A: &first,
+ B: 2,
+ }
+
+ dest := Foo{
+ A: &second,
+ B: 1,
+ }
+
+ mergo.Merge(&dest, src, mergo.WithOverride, mergo.WithoutDereference)
+}
+```
+
Additionally, you can map a `map[string]interface{}` to a struct (and
otherwise, from struct to map), following the same restrictions as in
`Merge()`. Keys are capitalized to find each corresponding exported field.
```go
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/vendor/dario.cat/mergo/map.go
new/vendor/dario.cat/mergo/map.go
--- old/vendor/dario.cat/mergo/map.go 2024-08-16 20:11:16.000000000 +0200
+++ new/vendor/dario.cat/mergo/map.go 2024-09-14 18:25:59.000000000 +0200
@@ -58,7 +58,7 @@
}
fieldName := field.Name
fieldName = changeInitialCase(fieldName,
unicode.ToLower)
- if v, ok := dstMap[fieldName]; !ok ||
(isEmptyValue(reflect.ValueOf(v), !config.ShouldNotDereference) || overwrite) {
+ if _, ok := dstMap[fieldName]; !ok ||
(!isEmptyValue(reflect.ValueOf(src.Field(i).Interface()),
!config.ShouldNotDereference) && overwrite) || config.overwriteWithEmptyValue {
dstMap[fieldName] = src.Field(i).Interface()
}
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/vendor/dario.cat/mergo/merge.go
new/vendor/dario.cat/mergo/merge.go
--- old/vendor/dario.cat/mergo/merge.go 2024-08-16 20:11:16.000000000 +0200
+++ new/vendor/dario.cat/mergo/merge.go 2024-09-14 18:25:59.000000000 +0200
@@ -269,7 +269,7 @@
if err = deepMerge(dst.Elem(),
src.Elem(), visited, depth+1, config); err != nil {
return
}
- } else {
+ } else if src.Elem().Kind() != reflect.Struct {
if overwriteWithEmptySrc || (overwrite
&& !src.IsNil()) || dst.IsNil() {
dst.Set(src)
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/vendor/github.com/Masterminds/semver/v3/CHANGELOG.md
new/vendor/github.com/Masterminds/semver/v3/CHANGELOG.md
--- old/vendor/github.com/Masterminds/semver/v3/CHANGELOG.md 2024-08-16
20:11:17.000000000 +0200
+++ new/vendor/github.com/Masterminds/semver/v3/CHANGELOG.md 2024-09-14
18:25:59.000000000 +0200
@@ -1,5 +1,33 @@
# Changelog
+## 3.3.0 (2024-08-27)
+
+### Added
+
+- #238: Add LessThanEqual and GreaterThanEqual functions (thanks @grosser)
+- #213: nil version equality checking (thanks @KnutZuidema)
+
+### Changed
+
+- #241: Simplify StrictNewVersion parsing (thanks @grosser)
+- Testing support up through Go 1.23
+- Minimum version set to 1.21 as this is what's tested now
+- Fuzz testing now supports caching
+
+## 3.2.1 (2023-04-10)
+
+### Changed
+
+- #198: Improved testing around pre-release names
+- #200: Improved code scanning with addition of CodeQL
+- #201: Testing now includes Go 1.20. Go 1.17 has been dropped
+- #202: Migrated Fuzz testing to Go built-in Fuzzing. CI runs daily
+- #203: Docs updated for security details
+
+### Fixed
+
+- #199: Fixed issue with range transformations
+
## 3.2.0 (2022-11-28)
### Added
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/vendor/github.com/Masterminds/semver/v3/Makefile
new/vendor/github.com/Masterminds/semver/v3/Makefile
--- old/vendor/github.com/Masterminds/semver/v3/Makefile 2024-08-16
20:11:17.000000000 +0200
+++ new/vendor/github.com/Masterminds/semver/v3/Makefile 2024-09-14
18:25:59.000000000 +0200
@@ -19,6 +19,7 @@
.PHONY: fuzz
fuzz:
@echo "==> Running Fuzz Tests"
+ go env GOCACHE
go test -fuzz=FuzzNewVersion -fuzztime=15s .
go test -fuzz=FuzzStrictNewVersion -fuzztime=15s .
go test -fuzz=FuzzNewConstraint -fuzztime=15s .
@@ -27,4 +28,4 @@
# Install golangci-lint. The configuration for it is in the
.golangci.yml
# file in the root of the repository
echo ${GOPATH}
- curl -sfL
https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s --
-b $(GOPATH)/bin v1.17.1
+ curl -sfL
https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s --
-b $(GOPATH)/bin v1.56.2
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/vendor/github.com/Masterminds/semver/v3/README.md
new/vendor/github.com/Masterminds/semver/v3/README.md
--- old/vendor/github.com/Masterminds/semver/v3/README.md 2024-08-16
20:11:17.000000000 +0200
+++ new/vendor/github.com/Masterminds/semver/v3/README.md 2024-09-14
18:25:59.000000000 +0200
@@ -13,12 +13,9 @@
[](https://pkg.go.dev/github.com/Masterminds/semver/v3)
[](https://goreportcard.com/report/github.com/Masterminds/semver)
-If you are looking for a command line tool for version comparisons please see
-[vert](https://github.com/Masterminds/vert) which uses this library.
-
## Package Versions
-Note, import `github.com/github.com/Masterminds/semver/v3` to use the latest
version.
+Note, import `github.com/Masterminds/semver/v3` to use the latest version.
There are three major versions fo the `semver` package.
@@ -80,12 +77,12 @@
differences to notes between these two methods of comparison.
1. When two versions are compared using functions such as `Compare`,
`LessThan`,
- and others it will follow the specification and always include prereleases
+ and others it will follow the specification and always include pre-releases
within the comparison. It will provide an answer that is valid with the
comparison section of the spec at https://semver.org/#spec-item-11
2. When constraint checking is used for checks or validation it will follow a
different set of rules that are common for ranges with tools like npm/js
- and Rust/Cargo. This includes considering prereleases to be invalid if the
+ and Rust/Cargo. This includes considering pre-releases to be invalid if the
ranges does not include one. If you want to have it include pre-releases a
simple solution is to include `-0` in your range.
3. Constraint ranges can have some complex rules including the shorthand use of
@@ -113,7 +110,7 @@
if err != nil {
// Handle version not being parsable.
}
-// Check if the version meets the constraints. The a variable will be true.
+// Check if the version meets the constraints. The variable a will be true.
a := c.Check(v)
```
@@ -137,20 +134,20 @@
### Working With Prerelease Versions
Pre-releases, for those not familiar with them, are used for software releases
-prior to stable or generally available releases. Examples of prereleases
include
-development, alpha, beta, and release candidate releases. A prerelease may be
+prior to stable or generally available releases. Examples of pre-releases
include
+development, alpha, beta, and release candidate releases. A pre-release may be
a version such as `1.2.3-beta.1` while the stable release would be `1.2.3`. In
the
-order of precedence, prereleases come before their associated releases. In this
+order of precedence, pre-releases come before their associated releases. In
this
example `1.2.3-beta.1 < 1.2.3`.
-According to the Semantic Version specification prereleases may not be
+According to the Semantic Version specification, pre-releases may not be
API compliant with their release counterpart. It says,
> A pre-release version indicates that the version is unstable and might not
> satisfy the intended compatibility requirements as denoted by its associated
> normal version.
-SemVer comparisons using constraints without a prerelease comparator will skip
-prerelease versions. For example, `>=1.2.3` will skip prereleases when looking
-at a list of releases while `>=1.2.3-0` will evaluate and find prereleases.
+SemVer's comparisons using constraints without a pre-release comparator will
skip
+pre-release versions. For example, `>=1.2.3` will skip pre-releases when
looking
+at a list of releases while `>=1.2.3-0` will evaluate and find pre-releases.
The reason for the `0` as a pre-release version in the example comparison is
because pre-releases can only contain ASCII alphanumerics and hyphens (along
with
@@ -171,6 +168,9 @@
* `1.2 - 1.4.5` which is equivalent to `>= 1.2 <= 1.4.5`
* `2.3.4 - 4.5` which is equivalent to `>= 2.3.4 <= 4.5`
+Note that `1.2-1.4.5` without whitespace is parsed completely differently; it's
+parsed as a single constraint `1.2.0` with _prerelease_ `1.4.5`.
+
### Wildcards In Comparisons
The `x`, `X`, and `*` characters can be used as a wildcard character. This
works
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/vendor/github.com/Masterminds/semver/v3/version.go
new/vendor/github.com/Masterminds/semver/v3/version.go
--- old/vendor/github.com/Masterminds/semver/v3/version.go 2024-08-16
20:11:17.000000000 +0200
+++ new/vendor/github.com/Masterminds/semver/v3/version.go 2024-09-14
18:25:59.000000000 +0200
@@ -83,22 +83,23 @@
original: v,
}
- // check for prerelease or build metadata
- var extra []string
- if strings.ContainsAny(parts[2], "-+") {
- // Start with the build metadata first as it needs to be on the
right
- extra = strings.SplitN(parts[2], "+", 2)
- if len(extra) > 1 {
- // build metadata found
- sv.metadata = extra[1]
- parts[2] = extra[0]
+ // Extract build metadata
+ if strings.Contains(parts[2], "+") {
+ extra := strings.SplitN(parts[2], "+", 2)
+ sv.metadata = extra[1]
+ parts[2] = extra[0]
+ if err := validateMetadata(sv.metadata); err != nil {
+ return nil, err
}
+ }
- extra = strings.SplitN(parts[2], "-", 2)
- if len(extra) > 1 {
- // prerelease found
- sv.pre = extra[1]
- parts[2] = extra[0]
+ // Extract build prerelease
+ if strings.Contains(parts[2], "-") {
+ extra := strings.SplitN(parts[2], "-", 2)
+ sv.pre = extra[1]
+ parts[2] = extra[0]
+ if err := validatePrerelease(sv.pre); err != nil {
+ return nil, err
}
}
@@ -114,7 +115,7 @@
}
}
- // Extract the major, minor, and patch elements onto the returned
Version
+ // Extract major, minor, and patch
var err error
sv.major, err = strconv.ParseUint(parts[0], 10, 64)
if err != nil {
@@ -131,23 +132,6 @@
return nil, err
}
- // No prerelease or build metadata found so returning now as a fastpath.
- if sv.pre == "" && sv.metadata == "" {
- return sv, nil
- }
-
- if sv.pre != "" {
- if err = validatePrerelease(sv.pre); err != nil {
- return nil, err
- }
- }
-
- if sv.metadata != "" {
- if err = validateMetadata(sv.metadata); err != nil {
- return nil, err
- }
- }
-
return sv, nil
}
@@ -381,15 +365,31 @@
return v.Compare(o) < 0
}
+// LessThanEqual tests if one version is less or equal than another one.
+func (v *Version) LessThanEqual(o *Version) bool {
+ return v.Compare(o) <= 0
+}
+
// GreaterThan tests if one version is greater than another one.
func (v *Version) GreaterThan(o *Version) bool {
return v.Compare(o) > 0
}
+// GreaterThanEqual tests if one version is greater or equal than another one.
+func (v *Version) GreaterThanEqual(o *Version) bool {
+ return v.Compare(o) >= 0
+}
+
// Equal tests if two versions are equal to each other.
// Note, versions can be equal with different metadata since metadata
// is not considered part of the comparable version.
func (v *Version) Equal(o *Version) bool {
+ if v == o {
+ return true
+ }
+ if v == nil || o == nil {
+ return false
+ }
return v.Compare(o) == 0
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/vendor/modules.txt new/vendor/modules.txt
--- old/vendor/modules.txt 2024-08-16 20:11:19.000000000 +0200
+++ new/vendor/modules.txt 2024-09-14 18:26:05.000000000 +0200
@@ -1,4 +1,4 @@
-# dario.cat/mergo v1.0.0
+# dario.cat/mergo v1.0.1
## explicit; go 1.13
dario.cat/mergo
# github.com/AlekSi/pointer v1.2.0
@@ -10,8 +10,8 @@
# github.com/Masterminds/goutils v1.1.1
## explicit
github.com/Masterminds/goutils
-# github.com/Masterminds/semver/v3 v3.2.1
-## explicit; go 1.18
+# github.com/Masterminds/semver/v3 v3.3.0
+## explicit; go 1.21
github.com/Masterminds/semver/v3
# github.com/Masterminds/sprig/v3 v3.2.3
## explicit; go 1.13
![https://liberapay.com/assets/widgets/donate.svg"](https://liberapay.com/assets/widgets/donate.svg"){kind=link}