v1.7.5
What's Changed
Prevent Git Config Alteration on Git Update by@dduzgun-security inhashicorp/go-getter#497
New Contributors
@dduzgun-security made their first contribution inhashicorp/go-getter#497
Full Changelog:hashicorp/go-getter@v1.7.4...v1.7.5

Commits

5a63fd9 Merge pull request#497 from hashicorp/fix-git-update
5b7ec5f fetch tags on update and fix tests
9906874 recreate git config during update to prevent config alteration
See full diff incompare view

Updatesgolang.org/x/crypto from 0.21.0 to 0.35.0

Commits

7292932 ssh: limit the size of the internal packet queue while waiting for KEX
f66f74b acme/autocert: check host policy before probing the cache
b0784b7 x509roots/fallback: drop obsolete build constraint
911360c all: bump golang.org/x/crypto dependencies of asm generators
89ff08d all: upgrade go directive to at least 1.23.0 [generated]
e47973b all: update certs for go1.24
9290511 go.mod: update golang.org/x dependencies
fa5273e x509roots/fallback: update bundle
a8ea4be ssh: add ServerConfig.PreAuthConnCallback, ServerPreAuthConn (banner) interface
71d3a4c acme: support challenges that require the ACME client to send a non-empty JSO...
Additional commits viewable incompare view

Updatesgolang.org/x/net from 0.23.0 to 0.38.0

Commits

e1fcd82 html: properly handle trailing solidus in unquoted attribute value in foreign...
ebed060 internal/http3: fix build of tests with GOEXPERIMENT=nosynctest
1f1fa29 publicsuffix: regenerate table
1215081 http2: improve error when server sends HTTP/1
312450e html: ensure <search> tag closes <p> and update tests
09731f9 http2: improve handling of lost PING in Server
55989e2 http2/h2c: use ResponseController for hijacking connections
2914f46 websocket: re-recommend gorilla/websocket
99b3ae0 go.mod: update golang.org/x dependencies
85d1d54 go.mod: update golang.org/x dependencies
Additional commits viewable incompare view

Updatesgolang.org/x/oauth2 from 0.8.0 to 0.27.0

Commits

681b4d8 jws: split token into fixed number of parts
3f78298 all: upgrade go directive to at least 1.23.0 [generated]
109dabf endpoints: add links/provider for Discord
ac571fa oauth2: fix docs for Config.DeviceAuth
314ee5b endpoints: add patreon endpoint
b9c813b google: add warning about externally-provided credentials
49a531d all: make method and struct comments match the names
22134a4 README: don't recommend go get
3e64809 x/oauth2: add Token.ExpiresIn
16a9973 jwt: rename example to avoid vet error
Additional commits viewable incompare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting@dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from theSecurity Alerts page.

chore(deps): bump the go_modules group across 1 directory with 4 updates

d1bf336

Bumps the go_modules group with 4 updates in the /test/src directory: [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter), [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/oauth2](https://github.com/golang/oauth2).Updates `github.com/hashicorp/go-getter` from 1.7.4 to 1.7.5- [Release notes](https://github.com/hashicorp/go-getter/releases)- [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml)- [Commits](hashicorp/go-getter@v1.7.4...v1.7.5)Updates `golang.org/x/crypto` from 0.21.0 to 0.35.0- [Commits](golang/crypto@v0.21.0...v0.35.0)Updates `golang.org/x/net` from 0.23.0 to 0.38.0- [Commits](golang/net@v0.23.0...v0.38.0)Updates `golang.org/x/oauth2` from 0.8.0 to 0.27.0- [Commits](golang/oauth2@v0.8.0...v0.27.0)---updated-dependencies:- dependency-name: github.com/hashicorp/go-getter  dependency-version: 1.7.5  dependency-type: indirect  dependency-group: go_modules- dependency-name: golang.org/x/crypto  dependency-version: 0.35.0  dependency-type: indirect  dependency-group: go_modules- dependency-name: golang.org/x/net  dependency-version: 0.38.0  dependency-type: indirect  dependency-group: go_modules- dependency-name: golang.org/x/oauth2  dependency-version: 0.27.0  dependency-type: indirect  dependency-group: go_modules...Signed-off-by: dependabot[bot] <support@github.com>