[PR #71] deps(deps): bump filippo.io/age from 1.2.1 to 1.3.1 #74

New issue

Closed

opened 2026-02-26 18:43:27 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 18:43:27 +03:00

Owner

Original Pull Request: https://github.com/devnullvoid/pvetui/pull/71

State: closed
Merged: Yes

Bumps filippo.io/age from 1.2.1 to 1.3.1.

Release notes

Sourced from filippo.io/age's releases.

v1.3.1 is a minor release to restore version injection from downstream package build processes.

See the v1.3.0 release notes for an overview of recent additions.

age v1.3.0: post-quantum (and more)!

Exactly six years after the first age beta release, v1.3.0 brings post-quantum resistance to age, along with a couple long-requested features, built-in support for recipients compatible with hardware plugins, I/O API improvements, and many usability enhancements.

Post-quantum recipients

age now has native post-quantum recipients based on HPKE with a hybrid ML-KEM-768 KEM. The recipients start with age1pq1..., and the identities start with AGE-SECRET-KEY-PQ-1....

To generate a post-quantum keypair:
$ age-keygen -pq
If you have your own age implementation, C2SP has the specification, and CCTV has test vectors for the new hybrid recipient types.

(If you are using an older age client, an optional plugin is available that provides out-of-the-box support for encryption to hybrid recipients. Hybrid identities can be converted to work with the plugin with age-plugin-pq -identity.)

New I/O APIs

The new DecryptReaderAt API implements seeking decryption, which can be used with zip.NewReader.

The new EncryptReader API implements pull-based encryption by wrapping an io.Reader, as opposed to wrapping an io.Writer like Encrypt.

age-inspect

The new age-inspect(1) tool presents the metadata of an age file without decrypting it.
hello.age is an age file, version "age-encryption.org/v1".
This file is ASCII-armored.
This file is encrypted to the following recipient types:

"mlkem768x25519"

This file uses post-quantum encryption.
Size breakdown (assuming it decrypts successfully):
Header                      1627 bytes
Armor overhead              1350 bytes
Encryption overhead           32 bytes
Payload                     1959 bytes
                    -------------------

</tr></table>

... (truncated)

Commits

b8564ad .github/workflows: inject version into source release artifact
e4c611f cmd,extra: restore the Version link-time variable
6a8065f SIGSUM.md: update policy for v1.3.0
50a600e .github/workflows: improve release reproducibility
13aab81 .github/workflows: build and release source tarball
52338c2 .github/workflows: enable GitHub artifact attestation
b70af41 cmd/age: don't output binary plaintext to terminal
4202739 internal/stream: fix DecryptReaderAt concurrency
da21917 age: add ExampleDecryptReaderAt with zip.NewReader
2ff5d34 age: add DecryptReaderAt
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

**Original Pull Request:** https://github.com/devnullvoid/pvetui/pull/71 **State:** closed **Merged:** Yes --- Bumps [filippo.io/age](https://github.com/FiloSottile/age) from 1.2.1 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/FiloSottile/age/releases">filippo.io/age's releases</a>.</em></p> <blockquote> <p>v1.3.1 is a minor release to restore version injection from downstream package build processes.</p> <p>See <a href="https://github.com/FiloSottile/age/releases/tag/v1.3.0">the v1.3.0 release notes</a> for an overview of recent additions.</p> <h2>age v1.3.0: post-quantum (and more)!</h2>  <p>Exactly six years after <a href="https://github.com/FiloSottile/age/releases/tag/v1.0.0-beta1">the first age beta release</a>, v1.3.0 brings post-quantum resistance to age, along with a couple long-requested features, built-in support for recipients compatible with hardware plugins, I/O API improvements, and many usability enhancements.</p> <h3>Post-quantum recipients</h3> <p>age now has native post-quantum recipients based on HPKE with a hybrid ML-KEM-768 KEM. The recipients start with <code>age1pq1...</code>, and the identities start with <code>AGE-SECRET-KEY-PQ-1...</code>.</p> <p>To generate a post-quantum keypair:</p> <pre><code>$ age-keygen -pq </code></pre> <p>If you have your own age implementation, C2SP has <a href="http://c2sp.org/age#the-mlkem768-x25519-ie-x-wing-hybrid-post-quantum-recipient-type">the specification</a>, and CCTV has <a href="https://github.com/C2SP/CCTV/tree/main/age">test vectors</a> for the new hybrid recipient types.</p> <p>(If you are using an older age client, <a href="https://github.com/FiloSottile/age/tree/main/extra/age-plugin-pq">an optional plugin</a> is available that provides out-of-the-box support for encryption to hybrid recipients. Hybrid identities can be converted to work with the plugin with <code>age-plugin-pq -identity</code>.)</p> <h3>New I/O APIs</h3> <p>The new <a href="https://filippo.io/age#DecryptReaderAt">DecryptReaderAt</a> API implements seeking decryption, which can be used with <a href="https://pkg.go.dev/archive/zip#NewReader">zip.NewReader</a>.</p> <p>The new <a href="https://filippo.io/age#EncryptReader">EncryptReader</a> API implements pull-based encryption by wrapping an io.Reader, as opposed to wrapping an io.Writer like <a href="https://filippo.io/age#Encrypt">Encrypt</a>.</p> <h3>age-inspect</h3> <p>The new <a href="https://htmlpreview.github.io/?https://github.com/FiloSottile/age/blob/main/doc/age-inspect.1.html">age-inspect(1) tool</a> presents the metadata of an age file without decrypting it.</p> <pre><code>hello.age is an age file, version "age-encryption.org/v1". <p>This file is ASCII-armored.</p> <p>This file is encrypted to the following recipient types:</p> <ul> <li>"mlkem768x25519"</li> </ul> <p>This file uses post-quantum encryption.</p> <p>Size breakdown (assuming it decrypts successfully):</p> <pre><code>Header 1627 bytes Armor overhead 1350 bytes Encryption overhead 32 bytes Payload 1959 bytes ------------------- </code></pre> <p></tr></table><br /> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/FiloSottile/age/commit/b8564adb6d58329b8a3e267360ca2b0abc4efe1d"><code>b8564ad</code></a> .github/workflows: inject version into source release artifact</li> <li><a href="https://github.com/FiloSottile/age/commit/e4c611f7788591615ce7aaa3022aef970f8c80ca"><code>e4c611f</code></a> cmd,extra: restore the Version link-time variable</li> <li><a href="https://github.com/FiloSottile/age/commit/6a8065f2da1cc3e00a1b4cb39bef5fbdf4c48960"><code>6a8065f</code></a> SIGSUM.md: update policy for v1.3.0</li> <li><a href="https://github.com/FiloSottile/age/commit/50a600eef58908b394750b5136fc825fb0650d0e"><code>50a600e</code></a> .github/workflows: improve release reproducibility</li> <li><a href="https://github.com/FiloSottile/age/commit/13aab81842ab690a438a36307438fefcbc04d12d"><code>13aab81</code></a> .github/workflows: build and release source tarball</li> <li><a href="https://github.com/FiloSottile/age/commit/52338c20dfda76394fc555026c609bdae4b2b02f"><code>52338c2</code></a> .github/workflows: enable GitHub artifact attestation</li> <li><a href="https://github.com/FiloSottile/age/commit/b70af412152535872ee5888c5eac4e8b516b188a"><code>b70af41</code></a> cmd/age: don't output binary plaintext to terminal</li> <li><a href="https://github.com/FiloSottile/age/commit/420273952ab2e5a321b984846411e973b8da867f"><code>4202739</code></a> internal/stream: fix DecryptReaderAt concurrency</li> <li><a href="https://github.com/FiloSottile/age/commit/da2191789a4db9a68ed5f078aca2ac49d55e7740"><code>da21917</code></a> age: add ExampleDecryptReaderAt with zip.NewReader</li> <li><a href="https://github.com/FiloSottile/age/commit/2ff5d341f60048df811511920737328b55bb54be"><code>2ff5d34</code></a> age: add DecryptReaderAt</li> <li>Additional commits viewable in <a href="https://github.com/FiloSottile/age/compare/v1.2.1...v1.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filippo.io/age&package-manager=go_modules&previous-version=1.2.1&new-version=1.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

kerem

2026-02-26 18:43:27 +03:00

closed this issue
added the
pull-request
label

kerem referenced this issue

2026-02-26 18:43:27 +03:00

[PR #74] deps(deps): bump github.com/gdamore/tcell/v2 from 2.13.5 to 2.13.7 #78

kerem changed title from ~~[PR #71] [MERGED] deps(deps): bump filippo.io/age from 1.2.1 to 1.3.1~~ to [PR #71] deps(deps): bump filippo.io/age from 1.2.1 to 1.3.1

2026-02-27 12:38:33 +03:00