Bump github.com/hashicorp/consul from 1.13.1 to 1.13.2 in /go-service

[dependabot[bot]]

Bumps github.com/hashicorp/consul from 1.13.1 to 1.13.2.

Release notes

Sourced from github.com/hashicorp/consul's releases.

v1.13.2

1.13.2 (September 20, 2022)

SECURITY:

• auto-config: Added input validation for auto-config JWT authorization checks. Prior to this change, it was possible for malicious actors to construct requests which incorrectly pass custom JWT claim validation for the AutoConfig.InitialConfiguration endpoint. Now, only a subset of characters are allowed for the input before evaluating the bexpr. [GH-14577]
• connect: Added URI length checks to ConnectCA CSR requests. Prior to this change, it was possible for a malicious actor to designate multiple SAN URI values in a call to the ConnectCA.Sign endpoint. The endpoint now only allows for exactly one SAN URI to be specified. [GH-14579]

FEATURES:

• cli: Adds new subcommands for peering workflows. Refer to the CLI docs for more information. [GH-14423]
• connect: Server address changes are streamed to peers [GH-14285]
• service-defaults: Added support for local_request_timeout_ms and local_connect_timeout_ms in servicedefaults config entry [GH-14395]

IMPROVEMENTS:

• connect: Bump latest Envoy to 1.23.1 in test matrix [GH-14573]
• connect: expose new tracing configuration on envoy [GH-13998]
• envoy: adds additional Envoy outlier ejection parameters to passive health check configurations. [GH-14238]
• metrics: add labels of segment, partition, network area, network (lan or wan) to serf and memberlist metrics [GH-14161]
• peering: Validate peering tokens for server name conflicts [GH-14563]
• snapshot agent: (Enterprise only) Add support for path-based addressing when using s3 backend.
• ui: Reuse connections for requests to /v1/internal/ui/metrics-proxy/ [GH-14521]

BUG FIXES:

• agent: Fixes an issue where an agent that fails to start due to bad addresses won't clean up any existing listeners [GH-14081]
• api: Fix a breaking change caused by renaming QueryDatacenterOptions to QueryFailoverOptions. This adds QueryDatacenterOptions back as an alias to QueryFailoverOptions and marks it as deprecated. [GH-14378]
• ca: Fixed a bug with the Vault CA provider where the intermediate PKI mount and leaf cert role were not being updated when the CA configuration was changed. [GH-14516]
• cli: When launching a sidecar proxy with consul connect envoy or consul connect proxy, the -sidecar-for service ID argument is now treated as case-insensitive. [GH-14034]
• connect: Fix issue where auto_config and auto_encrypt could unintentionally enable TLS for gRPC xDS connections. [GH-14269]
• connect: Fixed a bug where old root CAs would be removed from the primary datacenter after switching providers and restarting the cluster. [GH-14598]
• connect: Fixed an issue where intermediate certificates could build up in the root CA because they were never being pruned after expiring. [GH-14429]
• connect: Fixed some spurious issues during peering establishment when a follower is dialed [GH-14119]
• envoy: validate name before deleting proxy default configurations. [GH-14290]
• peering: Fix issue preventing deletion and recreation of peerings in TERMINATED state. [GH-14364]
• rpc: Adds max jitter to client deadlines to prevent i/o deadline errors on blocking queries [GH-14233]
• tls: undo breaking change that prevented setting TLS for gRPC when using config flags available in Consul v1.11. [GH-14668]
• ui: Removed Overview page from HCP instalations [GH-14606]

Changelog

Sourced from github.com/hashicorp/consul's changelog.

1.13.2 (September 20, 2022)

SECURITY:

• auto-config: Added input validation for auto-config JWT authorization checks. Prior to this change, it was possible for malicious actors to construct requests which incorrectly pass custom JWT claim validation for the AutoConfig.InitialConfiguration endpoint. Now, only a subset of characters are allowed for the input before evaluating the bexpr. [GH-14577]
• connect: Added URI length checks to ConnectCA CSR requests. Prior to this change, it was possible for a malicious actor to designate multiple SAN URI values in a call to the ConnectCA.Sign endpoint. The endpoint now only allows for exactly one SAN URI to be specified. [GH-14579]

FEATURES:

• cli: Adds new subcommands for peering workflows. Refer to the CLI docs for more information. [GH-14423]
• connect: Server address changes are streamed to peers [GH-14285]
• service-defaults: Added support for local_request_timeout_ms and local_connect_timeout_ms in servicedefaults config entry [GH-14395]

IMPROVEMENTS:

• connect: Bump latest Envoy to 1.23.1 in test matrix [GH-14573]
• connect: expose new tracing configuration on envoy [GH-13998]
• envoy: adds additional Envoy outlier ejection parameters to passive health check configurations. [GH-14238]
• metrics: add labels of segment, partition, network area, network (lan or wan) to serf and memberlist metrics [GH-14161]
• peering: Validate peering tokens for server name conflicts [GH-14563]
• snapshot agent: (Enterprise only) Add support for path-based addressing when using s3 backend.
• ui: Reuse connections for requests to /v1/internal/ui/metrics-proxy/ [GH-14521]

BUG FIXES:

• agent: Fixes an issue where an agent that fails to start due to bad addresses won't clean up any existing listeners [GH-14081]
• api: Fix a breaking change caused by renaming QueryDatacenterOptions to QueryFailoverOptions. This adds QueryDatacenterOptions back as an alias to QueryFailoverOptions and marks it as deprecated. [GH-14378]
• ca: Fixed a bug with the Vault CA provider where the intermediate PKI mount and leaf cert role were not being updated when the CA configuration was changed. [GH-14516]
• cli: When launching a sidecar proxy with consul connect envoy or consul connect proxy, the -sidecar-for service ID argument is now treated as case-insensitive. [GH-14034]
• connect: Fix issue where auto_config and auto_encrypt could unintentionally enable TLS for gRPC xDS connections. [GH-14269]
• connect: Fixed a bug where old root CAs would be removed from the primary datacenter after switching providers and restarting the cluster. [GH-14598]
• connect: Fixed an issue where intermediate certificates could build up in the root CA because they were never being pruned after expiring. [GH-14429]
• connect: Fixed some spurious issues during peering establishment when a follower is dialed [GH-14119]
• envoy: validate name before deleting proxy default configurations. [GH-14290]
• peering: Fix issue preventing deletion and recreation of peerings in TERMINATED state. [GH-14364]
• rpc: Adds max jitter to client deadlines to prevent i/o deadline errors on blocking queries [GH-14233]
• tls: undo breaking change that prevented setting TLS for gRPC when using config flags available in Consul v1.11. [GH-14668]
• ui: Removed Overview page from HCP instalations [GH-14606]

1.12.5 (September 20, 2022)

SECURITY:

• auto-config: Added input validation for auto-config JWT authorization checks. Prior to this change, it was possible for malicious actors to construct requests which incorrectly pass custom JWT claim validation for the AutoConfig.InitialConfiguration endpoint. Now, only a subset of characters are allowed for the input before evaluating the bexpr. [GH-14577]
• connect: Added URI length checks to ConnectCA CSR requests. Prior to this change, it was possible for a malicious actor to designate multiple SAN URI values in a call to the ConnectCA.Sign endpoint. The endpoint now only allows for exactly one SAN URI to be specified. [GH-14579]

IMPROVEMENTS:

... (truncated)

Commits

• 0e046bb update consul-containers
• 48a03a0 Stage 1.13.2
• 54c05c9 api: update sdk version
• 767a604 backport of commit 8be23dd6ffef72a5143bbf7d74246808aca00aec (#14683)
• 6fbe899 Backport of ui: Completely remove the Overview routes when running the UI in ...
• 3c321b6 Backport of doc(peering): missing network requirement for peering and the par...
• 15d9715 Allow setting TLS for gRPC with deprecated options [1.13.x] (#14668)
• 05a1747 backport of commit 546f1ec634297d1453c37118654a449ce97992db (#14666)
• 7d250aa Backport of docs: Search Refresh Fixes into release/1.13.x (#14662)
• 2866390 Backport of docs: Search Refresh Fixes into release/1.13.x (#14659)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.