chore(deps): bump github.com/microsoftgraph/msgraph-sdk-go from 1.101.0 to 1.102.0 in /blueprints/full-multi-node-cluster/tests in the gomod group across 1 directory - #793
Merged
Marcel Bindseil (bindsi) merged 1 commit intoSep 17, 2026
Merged
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Marcel Bindseil (bindsi)
approved these changes
Sep 9, 2026
Marcel Bindseil (bindsi)
left a comment
Marcel Bindseil (bindsi)
left a comment
Member
There was a problem hiding this comment.
Thanks for the Graph SDK update. Reviewed both module-file changes, matched the new checksums to the Go checksum database, and checked the existing Graph consumer API. Compile-only validation passed without executing cloud tests, and the current dependency/vulnerability checks and PR gate pass. Code approval only: update the branch and obtain a passing up-to-date validation gate before merge.
Member
|
Dependabot (@dependabot) rebase |
dependabot
Bot
force-pushed
the
dependabot/go_modules/blueprints/full-multi-node-cluster/tests/gomod-265b85947b
branch
from
September 9, 2026 12:13
28bd18b to
f89c561
Compare
Member
|
Dependabot (@dependabot) rebase |
dependabot
Bot
force-pushed
the
dependabot/go_modules/blueprints/full-multi-node-cluster/tests/gomod-265b85947b
branch
3 times, most recently
from
September 14, 2026 16:08
fdc3d59 to
f685164
Compare
29 tasks
Marcel Bindseil (bindsi)
added a commit
that referenced
this pull request
Sep 16, 2026
# Pull Request > **IMPORTANT:** Before submitting, please remove all sensitive data, secrets, tokens, or confidential information. Ensure you've redacted any NDA-covered information, IP addresses, resource names, or security-related details that shouldn't be publicly disclosed. ## Description <!-- Provide a detailed description of the changes in this PR --> Upgrade the HTTP broker and media-capture service lockfiles to `rustls 0.23.45` to resolve [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285). This addresses the shared Cargo Audit failure affecting the open Dependabot PRs without weakening the existing audit policy. ## Related Issue <!-- Link to the related issue (Use the format: Fixes #123 or Relates to #123) --> Relates to #793, #798, #802, #806, #807, and #808. These dependency PRs remain separate and must be refreshed and validated after this fix merges. ## Type of Change <!-- What type of change does this PR introduce? Mark relevant options with 'x' --> - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Blueprint modification or addition - [x] Component modification or addition - [ ] Documentation update - [ ] CI/CD pipeline change - [ ] Other (please describe): ## Implementation Details <!-- Describe the implementation details and approach taken --> - Update `rustls` from 0.23.40 to 0.23.45 in the HTTP broker and from 0.23.41 to 0.23.45 in media capture. - Update `rustls-webpki` to 0.103.15 in both lockfiles, plus the required broker crypto dependencies `aws-lc-rs 1.18.1` and `aws-lc-sys 0.45.0`. - Generate both updates with `cargo update -p rustls --precise 0.23.45`; leave manifests, application source, and advisory exceptions unchanged. ## Testing Performed <!-- Describe the testing you have performed or plan to perform --> <!-- For bug fixes: A regression test verifies the fix and prevents the issue from recurring --> - [ ] Terraform plan/apply - [ ] Blueprint deployment test - [ ] Unit tests - [ ] Integration tests - [ ] Bug fix includes regression test (see [Test Policy](docs/contributing/testing-validation.md)) - [ ] Manual validation - [x] Other: security audit and focused dependency compilation `cargo-audit 0.22.1` with `--deny warnings` passed for all 18 tracked Cargo lockfiles using the unchanged repository `.github/audit.toml` policy. Focused `cargo check --locked` passed for the changed crypto packages in both service dependency graphs. `git diff --check origin/main...HEAD` passed. Full HTTP broker compilation was attempted on macOS but is unavailable there: the unchanged Azure MQTT SDK references Linux-only `TcpTlsRx`/`TcpTlsTx` and TLS constants. Full service builds and tests remain pending in Linux CI; no application test pass is claimed. ## Validation Steps <!-- Provide steps that reviewers should follow to validate your changes --> 1. Run the existing Dependency Audit workflow, retaining its advisory configuration and `--deny warnings` setting. 2. Run the existing Linux Rust service build/test jobs for the HTTP broker and media-capture service. 3. Confirm the required PR Validation Gate succeeds before merging. ## Checklist <!-- Mark relevant options with 'x' --> - [ ] I have updated the documentation accordingly - [ ] I have added tests to cover my changes - [ ] All new and existing tests passed - [ ] I have run `terraform fmt` on all Terraform code - [ ] I have run `terraform validate` on all Terraform code - [ ] I have run `az bicep format` on all Bicep code - [ ] I have run `az bicep build` to validate all Bicep code - [ ] I have checked for any sensitive data/tokens that should not be committed - [ ] Lint checks pass (run applicable linters for changed file types) ## Security Review <!-- Required for PRs touching security-sensitive paths: - SECURITY.md - src/000-cloud/010-security-identity/ - deploy/ PRs modifying these paths require the `security-reviewed` label before merge. --> - [ ] No credentials, secrets, or tokens are hardcoded or logged - [ ] RBAC and identity changes follow least-privilege principles - [ ] No new network exposure or public endpoints introduced without justification - [ ] Dependency additions or updates have been reviewed for known vulnerabilities - [ ] Container image changes use pinned digests or SHA references ## Additional Notes <!-- Add any other context about the PR here --> The Checkov/ecdsa finding in #808 and transient Grype download failures in #806 are separate follow-ups. This PR changes only the two affected Rust lockfiles. ## Screenshots (if applicable) <!-- Add screenshots to show the changes, if applicable -->
Member
|
Dependabot (@dependabot) rebase |
Bumps the gomod group with 1 update in the /blueprints/full-multi-node-cluster/tests directory: [github.com/microsoftgraph/msgraph-sdk-go](https://github.com/microsoftgraph/msgraph-sdk-go). Updates `github.com/microsoftgraph/msgraph-sdk-go` from 1.101.0 to 1.102.0 - [Release notes](https://github.com/microsoftgraph/msgraph-sdk-go/releases) - [Changelog](https://github.com/microsoftgraph/msgraph-sdk-go/blob/main/CHANGELOG.md) - [Commits](microsoftgraph/msgraph-sdk-go@v1.101.0...v1.102.0) --- updated-dependencies: - dependency-name: github.com/microsoftgraph/msgraph-sdk-go dependency-version: 1.102.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/go_modules/blueprints/full-multi-node-cluster/tests/gomod-265b85947b
branch
from
September 17, 2026 09:15
f685164 to
3de6a36
Compare
Marcel Bindseil (bindsi)
deleted the
dependabot/go_modules/blueprints/full-multi-node-cluster/tests/gomod-265b85947b
branch
September 17, 2026 10:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the gomod group with 1 update in the /blueprints/full-multi-node-cluster/tests directory: github.com/microsoftgraph/msgraph-sdk-go.
Updates
github.com/microsoftgraph/msgraph-sdk-gofrom 1.101.0 to 1.102.0Release notes
Sourced from github.com/microsoftgraph/msgraph-sdk-go's releases.
Changelog
Sourced from github.com/microsoftgraph/msgraph-sdk-go's changelog.
Commits
f60ea36Merge pull request #1026 from microsoftgraph/release-please--branches--main--...fa14a74chore(main): release 1.102.03e90e20Merge pull request #1030 from microsoftgraph/v1.0/pipelinebuild/23804851cf12ffeat(generation): update request builders and modelsbb2d876Merge pull request #1024 from microsoftgraph/v1.0/pipelinebuild/2340774b157affeat(generation): update request builders and models30ca7cdMerge pull request #1021 from microsoftgraph/ci/update-daily-build-cron-07001a58ecfci: update daily build schedule