build(deps): bump dagger.io/dagger from 0.14.0 to 0.15.1 in /action

[dependabot]

Bumps dagger.io/dagger from 0.14.0 to 0.15.1.

Changelog

Sourced from dagger.io/dagger's changelog.

sdk/go/v0.15.1 - 2024-12-12

This SDK uses 🚙 Engine + 🚗 CLI version v0.15.1. See what changed in that release.

🐹 https://pkg.go.dev/dagger.io/[email protected]

Dependencies

• Bump Engine to v0.15.1 by @​cwlbraa in dagger/dagger#9183

What to do next

• Read the documentation
• Join our Discord server
• Follow us on Twitter

sdk/go/v0.15.0 - 2024-12-11

This SDK uses 🚙 Engine + 🚗 CLI version v0.15.0. See what changed in that release.

🐹 https://pkg.go.dev/dagger.io/[email protected]

🔥 Breaking Changes

• Removed deprecated unscoped enum values by @​jedevc in dagger/dagger#8669
  Enum values must now be accessed with the name prefixed by the name of the enum type - for example, dagger.Shared becomes dagger.CacheSharingModeLocked.
• ExecErr.Error no longer contains the values of Stdout or Stderr by @​vito in dagger/dagger#9033
  When comparing error values for expected output, use the more specific values.

Dependencies

• Bump Engine to v0.15.0 by @​jedevc in dagger/dagger#9158

What to do next

• Read the documentation
• Join our Discord server
• Follow us on Twitter

Commits

• 4303d99 chore: prep for v0.15.1 (#9183)
• 92069b3 upgrade golang.org/x/crypto dep to avoid CVE (#9172)
• 6eeb37b chore: update release date for v0.15.0 (#9166)
• d665c65 chore: prep for v0.15.0 (#9158)
• 38c89e6 shell: reimplement module loading and execution according to new model (#9097)
• be9da24 fix(engine): use default args for starting container as service (#8865)
• 682852f Filesync performance improvements (#8818)
• efadaf7 chore: bump next version to v0.15.0 (#9073)
• ff2070a bump seconv to v1.25.0 to match otel v1.27.0 (#9067)
• c209a4d Preserve ExecError Stdout/Stderr, just don't show it (#9033)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[MDr164]

Looks like the only failing check here is the CVE check on an indirect dep so far.

[AtomicFS]

If the go-test works fine, then just merge by bypassing the rules.

[MDr164]

I just bumped that particular indirect one as well, locally it was building just fine with it

[MDr164]

Looks like it's getting stuck somewhere, likely #476 I suppose?

[AtomicFS]

That is certainly possible. Which is the reason why we could not merge #482 yet. I just don't know why it is getting stuck, and I can't be bothered at the moment to debug it (if it is still relevant I will take a look after Christmas).

If it fails in 60 minutes, then it is definitely #476.

[MDr164]

Same thing happens locally. Let me check if the timeout of 5s resolves it and I'll update both PRs.

[AtomicFS]

#476 does not resolve it, it just makes it fail faster.

[AtomicFS]

Must be some kind of breaking change in dagger v0.15.x.

[MDr164]

Yep, adding the timeout un-stucks the test. I'll try to find out what was changed for dagger to behave different here now.

[MDr164]

sshServiceTunnel, err := client.Host().Tunnel(sshServiceDoc).Start(ctx) this line in ssh.go blocks indefinitely for whatever reason...

[AtomicFS]

So, basically, I think that it would be better to drop the whole SSH feature and replace it with #269. Especially if fixing the SSH will take long time, it might be better investment.

Do you know how severe is the security 12 issue? The previous one security issue 11 had minimal impact since it was affecting only testing.

[MDr164]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[MDr164]

@dependabot recreate

[AtomicFS]

Not sure if it is wort it to invest any time into this because of:

So, basically, I think that it would be better to drop the whole SSH feature and replace it with #269. Especially if fixing the SSH will take long time, it might be better investment.

[MDr164]

Not sure if it is wort it to invest any time into this because of:

So, basically, I think that it would be better to drop the whole SSH feature and replace it with #269. Especially if fixing the SSH will take long time, it might be better investment.

Probably not, can you tell dependabot to ignore a dep or do we just wanna keep the PR around until it's changed?

[AtomicFS]

We could just close the PR and dependabot will get the message ;)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[AtomicFS]

@dependabot ignore

[dependabot]

Sorry, the command you entered is not valid for this pull request. Please check the syntax and try again.

Valid commands:
For single dependency PRs, use commands like:
@dependabot ignore this major version
@dependabot ignore this minor version
@dependabot ignore this dependency

[AtomicFS]

@dependabot ignore this dependency

[dependabot]

OK, I won't notify you about dagger.io/dagger again, unless you re-open this PR.

[AtomicFS]

oh wait :D we should not ignore this :D sorry, faster typing than thinking :D

[AtomicFS]

@dependabot unignore

[dependabot]

Sorry, the command you entered is not valid. Valid commands:
@dependabot unignore <dependency name> <ignore condition>
@dependabot unignore <dependency name> dependency

[AtomicFS]

@dependabot unignore dagger.io/dagger dependency

[dependabot]

OK, I will stop ignoring the dagger.io/dagger dependency.

[dependabot]

Looks like this PR is closed. If you re-open it I'll rebase it as long as no-one else has edited it (you can use @dependabot reopen if the branch has been deleted).

[AtomicFS]

I will ask dependabot to recreate this once we merge something for #269