Bump github.com/cloudfoundry-community/go-cfenv from 1.18.0 to 1.24.1

[dependabot]

Bumps github.com/cloudfoundry-community/go-cfenv from 1.18.0 to 1.24.1.

Release notes

Sourced from github.com/cloudfoundry-community/go-cfenv's releases.

go-cfenv v1.24.1

Release v1.24.1

[Chores]

• Workflow actions are now pinned to full commit SHAs with the release version as a trailing comment. Dependabot keeps updating SHA pins, and its action bumps now arrive grouped as a single weekly PR.

go-cfenv v1.24.0

Release v1.24.0

[Chores]

• Re-vendored mk/bump.mk, which no longer produces a prerelease that sorts before the release it follows. Applying a label to a final version gave v1.23.0-dev.1 after v1.23.0 — older than its own release, and unselectable by any resolver. The core now advances first, by BUMP_PRERELEASE_STEP (default minor, which matches this project's cadence), so make bump dev yields v1.24.0-dev.1. This is what lets interim versions be published for review between releases, satisfying the OpenSSF Best Practices repo_interim criterion. (#39)
• Documented the project's testing policy in CONTRIBUTING.md: new functionality arrives with tests, a bug fix arrives with a test that fails without it, and make check plus make test-race gate every pull request. The practice was already followed; it was not written down. (#39)
• Added the OpenSSF Best Practices badge to the README. The project is registered as entry 13896; the badge links to the self-certification and reports its current level. Scorecard reads this badge from the README, so its CII-Best-Practices check was scoring 0 while the entry existed but went uncited. (#39)

go-cfenv v1.23.0

Release v1.23.0

[Breaking Changes]

• The minimum Go version is now 1.25 (was 1.18). Consumers on an older toolchain must stay on v1.22.0. The old floor had become what blocked dependency maintenance: every current release of golang.org/x/net, golang.org/x/text and gomega declares a directive above it. (#38)

[Chores]

• gomega moved to v1.42.1, which depends on the maintained go.yaml.in/yaml/v3 instead of the archived gopkg.in/yaml.v3. The .modrotignore exemption that covered the archived module recorded exactly this as its removal condition, and is now gone — the archived-dependency gate runs with no exemptions at all.
• The copyloopvar and intrange linters now run. They were already enabled in .golangci.yml but golangci-lint disabled them at runtime for being newer than the project's go directive.
• Added make fuzz, a fuzz target over the VCAP_APPLICATION and VCAP_SERVICES parsing that New performs. Both documents come from the platform rather than the app, so they are the package's untrusted boundary. (#39)

[Security Updates]

• golang.org/x/net and golang.org/x/text moved to current releases, clearing the 16 known vulnerabilities their pinned versions carried between them (15 in x/net v0.35.0, 1 in x/text v0.22.0). None were reachable from this package's code, so govulncheck was always green — but scanners that report on presence rather than reachability were not, and consumers run those. (#38)

go-cfenv v1.22.0

Release v1.22.0

[Features]

• Service bindings are now read from the file named by VCAP_SERVICES_FILE_PATH when Cloud Foundry provides it, so apps with the file-based-vcap-services feature enabled work without any application change. That feature exists for bindings too large for an environment variable (RFC-0030); with it enabled Cloud Foundry does not set VCAP_SERVICES at all, which previously made cfenv.Current fail outright. The SERVICE_BINDING_ROOT form of the RFC is not supported — it follows the Kubernetes servicebinding.io layout, which has no faithful translation into the VCAP_SERVICES shape. (#28)

go-cfenv v1.21.0

Release v1.21.0

[Features]

• Service now captures the binding metadata Cloud Foundry sends but the decoder previously discarded: SyslogDrainURL, InstanceGUID, InstanceName, BindingGUID and BindingName. SyslogDrainURL is what cf cups -l sets on a user-provided instance, and InstanceName recovers the instance name for a named binding, where Name holds the binding name instead. (#25)

go-cfenv v1.20.0

Release v1.20.0

[Features]

• Service.Credential(keys ...string) reads a credential at any depth and returns it with its own type, so nested values like protocols.amqp.uri and non-string leaves like protocols.amqp.ssl are reachable. Passing the keys separately means every key is addressable, including one containing a dot such as jdbc.url. (#23)
• Service.CredentialPath("protocols.amqp.uri") is the dot-delimited form of the same lookup. It cannot address a key that itself contains a dot — use Credential for those.

[BugFixes]

... (truncated)

Commits

• 2bb88e1 Pin workflow actions to commit SHAs
• 4d6cd29 Sweep the fragments consumed by v1.24.0
• ee4e601 Show the OpenSSF Best Practices badge
• 0125cf1 Write down the testing policy
• 577149e Publish interim versions between releases
• 9404b07 Sweep the fragment consumed by v1.23.0
• aa9a7eb Add release notes for the go floor bump
• 88f6625 Fuzz the VCAP_APPLICATION/VCAP_SERVICES parser
• 840d188 Raise the go directive floor to 1.25
• 9de8487 Sweep the fragment consumed by v1.22.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)