Bump the go_modules group across 1 directory with 2 updates

[dependabot]

Bumps the go_modules group with 1 update in the / directory: github.com/gogo/protobuf.

Updates github.com/gogo/protobuf from 1.1.1 to 1.3.2

Release notes

Sourced from github.com/gogo/protobuf's releases.

Release v.1.3.2

Tested versions:

go 1.15.6 protoc 3.14.0

Bug fixes:

skippy peanut butter

Release v1.3.1

Tested versions:

go 1.12.10 protoc 3.9.1

Bug fixes:

• proto/buffer: fix proto.Buffer marshaling.
  • Thanks: https://github.com/apelisse
• plugin/gostring: generate values instead of pointers when a field is repeated and non-nullable.
  • Thanks https://github.com/godfried
• protoc-gen-gogo/generator: Generate json and custom tags for oneof
  • Thanks: https://github.com/krhubert
• plugin/marshalto: Use ProtoSize() in MarshalTo when enabled for oneof fields.
  • Thanks: https://github.com/gaffneyc

Upstream commits:

• 4c88cc3f1a34ffade77b79abc53335d1e511f25b - all: fix reflect.Value.Interface races.
• 6c65a5562fc06764971b7c5d05c76c75e84bdbf7 - jsonpb: fix marshaling of Duration
• b285ee9cfc6c881bb20c0d8dc73370ea9b9ec90f - Log parsing errors using log pkg

Misc:

• add github workflow config
• protoc update - Updated to protoc 3.9.1

Release v1.3.0

Tested versions:

go 1.12.9 protoc 3.7.1

Improvements:

• plugin/stringer - Handle repeated and/or nullable types a bit better now.
• plugin/size - Remove the loop in sovXXX by using bit twiddling.
  • Thanks: https://github.com/apelisse
• plugin/marshalto - Implemented a reverse marshal strategy which allows for faster marshalling. This now avoids a recursive (and repeated) call to Size().
  • Thanks: https://github.com/apelisse
• plugin/compare - Added support for for oneof types.

Bug fixes:

• protoc-gen-gogo/generator - Fix assignment to entry in nil map.
  • Thanks: https://github.com/tgulacsi
• protoc-gen-gogo/generator - Allows plugins to call RecordTypeUse without panicking.
  • Thanks: https://github.com/fedenusy

... (truncated)

Commits

• b03c65e skippy peanut butter
• 550e889 update to go version 1.15.6 and protoc 3.14.0 (#717)
• deb6fe8 Update Readme.md
• 5628607 github/workflow - update protoc version to 3.9.1 (#637)
• 09ab773 Issue619safer (#627)
• 8142193 GoString plugin: generate values instead of pointers when a field is repeated...
• 627c0c9 umarshal - refactor skip from recursive calls to a loop. (#636)
• 69adf3e Ghworkflow (#632)
• 8a5ed79 Merge pull request #622 from jmarais/master
• 33d4760 merged in golang/protobuf commit 4c88cc3f1a34ffade77b79abc53335d1e511f25b - a...
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.0.0-20190426145343-a29dc8fdc734 to 0.0.0-20200622213623-75b288015ac9

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​crypto@​v0.0.0-20190426145343-a29dc8fdc734 ⏵ v0.0.0-20200622213623-75b288015ac9	+1

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Network access: golang github.com/yuin/goldmark Location: Package overview From: ? → golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9 → golang/github.com/yuin/goldmark@v1.2.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/yuin/goldmark@v1.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: golang golang.org/x/mod Location: Package overview From: ? → golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9 → golang/golang.org/x/mod@v0.3.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/mod@v0.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: golang golang.org/x/mod Location: Package overview From: ? → golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9 → golang/golang.org/x/mod@v0.3.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/mod@v0.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: golang golang.org/x/sync Location: Package overview From: ? → golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9 → golang/golang.org/x/sync@v0.0.0-20201020160332-67f06af15bc9 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/sync@v0.0.0-20201020160332-67f06af15bc9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Native binaries present: golang golang.org/x/tools Location: Package overview From: ? → golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9 → golang/golang.org/x/tools@v0.0.0-20210106214847-113979e3529a ℹ Read more on: This package | This alert | Why is native code a concern? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/tools@v0.0.0-20210106214847-113979e3529a. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: golang golang.org/x/tools Location: Package overview From: ? → golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9 → golang/golang.org/x/tools@v0.0.0-20210106214847-113979e3529a ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/tools@v0.0.0-20210106214847-113979e3529a. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: golang golang.org/x/tools Location: Package overview From: ? → golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9 → golang/golang.org/x/tools@v0.0.0-20210106214847-113979e3529a ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/tools@v0.0.0-20210106214847-113979e3529a. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report