chore(deps): bump the minor-and-patch group across 1 directory with 17 updates

[dependabot]

Bumps the minor-and-patch group with 17 updates in the / directory:

Package	From	To
github.com/beevik/etree	1.7.1	1.8.0
github.com/huandu/xstrings	1.5.0	1.6.0
github.com/mattn/go-sqlite3	1.14.50	1.14.52
github.com/nats-io/nats-server/v2	2.14.6	2.15.0
github.com/onsi/ginkgo/v2	2.32.1	2.33.0
github.com/onsi/gomega	1.43.0	1.43.1
github.com/prometheus/alertmanager	0.34.0	0.34.1
github.com/tus/tusd/v2	2.10.0	2.10.1
golang.org/x/crypto	0.56.0	0.57.0
golang.org/x/exp	0.0.0-20260410095643-746e56fc9e2f	0.0.0-20260611194520-c48552f49976
golang.org/x/oauth2	0.36.0	0.37.0
golang.org/x/sync	0.22.0	0.23.0
golang.org/x/sys	0.47.0	0.48.0
golang.org/x/term	0.45.0	0.46.0
golang.org/x/text	0.41.0	0.42.0
google.golang.org/genproto	0.0.0-20260319201613-d00831a3d3e7	0.0.0-20260622175928-b703f567277d
google.golang.org/grpc	1.83.2	1.84.0

Updates github.com/beevik/etree from 1.7.1 to 1.8.0

Release notes

Sourced from github.com/beevik/etree's releases.

Release v1.8.0

Changes

• Added the Remove function to all token types, allowing for the easy removal of a token from its parent element.

Fixes

• Cleaned up several comments for clarity and typo corrections.

Changelog

Sourced from github.com/beevik/etree's changelog.

Release 1.8.0

Changes

• Added the Remove function to all token types, allowing for the easy removal of a token from its parent element.

Fixes

• Cleaned up several comments for clarity and typo corrections.

Commits

• 1850f3e Release v1.8.0
• c9eec49 Add Remove function to all tokens
• See full diff in compare view

Updates github.com/huandu/xstrings from 1.5.0 to 1.6.0

Release notes

Sourced from github.com/huandu/xstrings's releases.

Bug fixes for Scrub, Slice, Successor, ToCamelCase and Translate

Bug fixes for Scrub, Slice, Successor, ToCamelCase and Translate, plus a much bigger test suite.

Bug fixes

Scrub

• When a run of invalid bytes was at the end of the input, Scrub appended the already written prefix a second time and kept the invalid bytes as they were: Scrub("abc\xFF", "*") returned "abcabc\xFF" instead of "abc*", and Scrub("ab\xFFcd\xFE", "*") returned "ab*cdcd\xFE" instead of "ab*cd*" (#60, thanks @​vitalivo).

Slice

• Slice with a negative end (i.e. "slice to the end of the string") did not validate start against the rune count, so an out-of-range start returned an empty string instead of panicking: Slice("abc", 4, -1), Slice("中文", 3, -1) and Slice("", 1, -1) all returned "". They now panic with "out of range", as the document promises (#61, thanks @​vitalivo).

Successor

• The carry rune generated by '9' was inserted as '0' instead of '1', so Successor("9") returned "00" instead of "10" (and "99" → "000", "9z" → "00a") (#62).
• The prefix in front of an inserted carry rune was sliced with a rune index used as a byte offset, which cut multibyte runes and produced invalid UTF-8: Successor("中z") returned "\xe4aa" instead of "中aa" (#63).
• A carry was allowed to cross a letter/digit boundary after a non-alphanumeric rune, which differs from Ruby's String#succ: Successor("8a_9") returned "8b_0" instead of "8a_10", Successor("1*z") returned "2*a" instead of "1*aa" (#67). A differential test against Ruby over 20000 random ASCII strings now reports zero mismatches.

ToCamelCase / ToPascalCase

• A string which contains connectors only got its last rune duplicated: ToCamelCase("_") returned "__", ToCamelCase(" ") returned " ", ToCamelCase("-_-") returned "-_--" (#64).

Translate / Delete

• Once one rune had been translated, every unmatched rune which decodes to utf8.RuneError was dropped. A valid U+FFFD rune which did not match the pattern disappeared, and invalid bytes were removed as well: Translate("a\uFFFDb", "a", "x") returned "xb" instead of "x\uFFFDb", Delete("a\uFFFDb", "a") returned "b" instead of "\uFFFDb" (#65).
• A mapping whose target rune is U+0000 was silently ignored, because 0 was used as the "no mapping" marker: Translate("hello", "h", "\x00") returned "hello" instead of "\x00ello" (#66).

Behaviour changes

Two results change on purpose. Please check them if you depend on the exact output:

• Translate/Delete now keep every rune which does not match the pattern, including a valid U+FFFD, and invalid bytes are passed through as is instead of being rewritten as U+FFFD. As a consequence, Translate("hel\uFFFDlo", "^\uFFFD", "H") returns "HHH\uFFFDHH" (it returned "HHHHH" before), and Len(Delete(s, pattern)) + Count(s, pattern) == Len(s) now holds for every input.
• Successor stops a carry in front of a rune of another kind (letter vs. number), which is what Ruby's String#succ does. As before, only ASCII runes are treated as alphanumeric (documented in Successor), so for input which mixes CJK and ASCII the rule applies to the ASCII runes: Successor("中cZ英ZZ文zZ混9zZ9杂99进z位") returns "中cZ英ZZ文zZ混9zZ9杂99进aa位" (it returned "中dA英AA文aA混0aA0杂00进a位" before).

Tests

• Statement coverage grows from 97.4% to 99.9%.
• Boundary and regression tests for every exported function.
• The Translator API (HasPattern, TranslateRune, reusing a Translator) is covered by tests now; it had none before.
• Regression tests for all of the fixes listed above.

Thanks

Thank you @​vitalivo for the two pull requests in this release:

• #60 Replace trailing invalid byte runs in Scrub
• #61 Check the start bound of open-ended rune slices

Full Changelog: huandu/xstrings@v1.5.0...v1.6.0

Commits

• 559cb39 test: rename knownissue_test.go to regression_test.go
• a9c8b9d Merge bug/successor-carry-across-rune-kind: fix #67
• ea39bc2 fix #67: stop a carry in front of a rune of another kind
• cf0b325 Merge bug/translate-to-nul: fix #66
• 9831e9e fix #66: support translating a rune to U+0000
• adf61e1 Merge bug/translate-unmatched-runeerror: fix #65
• 610c09e fix #65: keep unmatched runes when translating a string
• 0842804 Merge bug/camel-case-trailing-connector: fix #64
• a9fcd95 fix #64: stop duplicating the last rune of a connector-only input
• 82cd3c3 Merge bug/successor-rune-index-as-byte-offset: fix #63
• Additional commits viewable in compare view

Updates github.com/mattn/go-sqlite3 from 1.14.50 to 1.14.52

Release notes

Sourced from github.com/mattn/go-sqlite3's releases.

1.14.52

What's Changed

• Replace schema probe with eager first step for cached statements by @​mattn in mattn/go-sqlite3#1454

Full Changelog: mattn/go-sqlite3@v1.14.51...v1.14.52

1.14.51

What's Changed

• fix: Exec returns wrong arg count in "not enough args" error by @​semihbkgr in mattn/go-sqlite3#1396
• refactor: Clean up deprecated // +build legacy build tags by @​zxysilent in mattn/go-sqlite3#1428
• Fixed som typos and wrappings in sqlite3_func_crypt.go documentation. by @​kberov in mattn/go-sqlite3#1367
• Replace copy-on-write handle map with sync.Map by @​mattn in mattn/go-sqlite3#1453
• Avoid per-row goroutines for query cancellation by @​bradengroom in mattn/go-sqlite3#1444
• Flush statement cache when the schema changes by @​mattn in mattn/go-sqlite3#1452

New Contributors

• @​semihbkgr made their first contribution in mattn/go-sqlite3#1396
• @​zxysilent made their first contribution in mattn/go-sqlite3#1428
• @​kberov made their first contribution in mattn/go-sqlite3#1367
• @​bradengroom made their first contribution in mattn/go-sqlite3#1444

Full Changelog: mattn/go-sqlite3@v1.14.50...v1.14.51

Commits

• b0be46f Merge pull request #1454 from mattn/fix-stmt-cache-probe-cost
• c8212b8 Replace schema probe with eager first step for cached statements
• d7f5da7 Merge pull request #1452 from mattn/fix-stmt-cache-schema-change
• 6428cad Merge pull request #1444 from bradengroom/codex/efficient-query-cancellation
• be93f7a Merge pull request #1453 from mattn/fix-handle-map-quadratic
• 5b285a1 Merge branch 'master' into codex/efficient-query-cancellation
• 2294cd9 Replace copy-on-write handle map with sync.Map
• 5341cee Gate cache on runtime version and skip probing in transactions
• c7ed68d Flush statement cache when the schema changes
• 6507893 Merge pull request #1367 from kberov/typos
• Additional commits viewable in compare view

Updates github.com/nats-io/nats-server/v2 from 2.14.6 to 2.15.0

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.15.0

Changelog

Refer to the 2.15 Upgrade Guide for backwards compatibility notes with 2.14.x. This release also contains all changes up to and including v2.14.7.

Go Version

• 1.27.1 (#8551)

Added

JetStream

• Desired state metalayer (#8432, #8437, #8439, #8443, #8452, #8460, #8476, #8576, #8598, #8602, #8603)
  • A new desired state reconciliation engine for streams and consumers considerably improves the safety and reliability of asset moves and scales
  • Updating the placement or replication factor midway through an existing scale/move operation, cancelling an in-flight scale/move, or peer-removing is now much safer
  • ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md
• Cancel stream move endpoint (#8476)
  • An in-flight scale/move operation on a stream can be cancelled and the asset returned to its original placement using the new $JS.API.STREAM.CANCEL_MOVE endpoint
  • ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md
• Evacuate endpoints (#8443)
  • The new $JS.API.SERVER.EVACUATE endpoint can safely evacuate streams, and any consumers on those streams, from a node
  • The new $JS.API.STREAM.PEER.EVACUATE.* endpoint can safely evacuate a peer, and any consumers on that peer, from a stream
  • These operations combined allow for maintenance operations with full transfer of data and state without having to peer-remove first
  • ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-62.md
• Metalayer rescue for disaster recovery (#8408)
  • The new $JS.API.META.RESCUE endpoint can temporarily lower the quorum-needed for the metalayer, in order to facilitate the recovery of a system where nodes have been permanently lost and the metalayer cannot reach quorum
  • ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-61.md
• Stream backup and restore v2 (#7882, #8584, #8591, #8604)
  • A new backup format for stream snapshots which reads out per-message rather than per-block
  • The new backup format also now correctly includes non-replicated consumers on follower nodes
  • ADR: https://github.com/nats-io/nats-architecture-and-design/blob/main/adr/ADR-63.md
• Detect source stream recreation (#8384)
  • The server now detects a source stream being recreated, restarting the sourcing back from the beginning, ensuring new messages are sourced
• Stream source indexing (#8282, #8516, #8283)
  • Restarts and leader changes previously required expensive backward scans through the stream to find the last sourced indices. These are now persisted in an index for instant lookup.
• Domain-prefixed JS API in system account (#8429)
  • When a system account is bridged between the hub and a leaf node, the domain-prefixed JS API can now be used to operate on the leaf node while directly connected to the hub

Changed

JetStream

• Streams now have a default limit of 1000 consumers, unless max_consumers is specified in the stream config or account limits (#8337, #8566)
  • Applications planning to use a large number of consumers on a stream should configure max_consumers in the stream config or account limits to an appropriately high number
  • The server-wide default of 1000 can be overridden by setting default_max_consumers in the JetStream limits, or can be disabled by setting to -1
  • This limit does not affect existing consumers and will not result in consumer deletions, only the creation of new consumers is prevented
• Sync changes for replicated streams (#8447)
  • When the sync_interval is set to always, replicated streams now sync their WAL entries but no longer sync upper stream layer writes
  • The synced log allows the stream to recover safely, but removing unnecessary syncs from the upper stream layer dramatically improves performance

... (truncated)

Commits

• eb76367 Release v2.15.0
• 8f3f31b [FIXED] Config reload disconnects operator mode clients sending an nkey (#8609)
• 7d77240 [FIXED] Stream scale down into a missing account tier was accepted (#8608)
• e46d21f [FIXED] Concurrent account updates invalidating stream imports (#8610)
• 2ecd77a De-flake TestJetStreamClusterHardKillAfterStreamAdd
• 901df78 De-flake TestJetStreamClusterAccountMaxConnectionsReconnect
• e133a1f De-flake TestJetStreamClusterMessageTTLCatchup
• 2990f6c [FIXED] Concurrent account updates invalidating stream imports
• 51fd55f De-flake TestJWTImportsOnServerRestartAndClientsReconnect
• 6a82cf9 De-flake TestNoRaceRouteSendSubs
• Additional commits viewable in compare view

Updates github.com/onsi/ginkgo/v2 from 2.32.1 to 2.33.0

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.33.0

Features

• The JUnit reporter now records each spec's ReportEntrys as <properties> on its <testcase> element, with the entry's name and its JSON-encoded value. Thanks @​pohly! [23db51a]

Maintenance

• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. See RELEASING.md. [8616ecb]

v2.32.2

2.32.2

Fixes

• fix bug where ginkgo -race -p was taking extra long to exit [c6792b0]

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.33.0

Features

• The JUnit reporter now records each spec's ReportEntrys as <properties> on its <testcase> element, with the entry's name and its JSON-encoded value. Thanks @​pohly! [23db51a]

Maintenance

• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. See RELEASING.md. [8616ecb]

2.32.2

Fixes

• fix bug where ginkgo -race -p was taking extra long to exit [c6792b0]

Commits

• 9f94149 v2.33.0
• db78e1b changelog: entries for the JUnit ReportEntry support and the release flow
• 8616ecb ci: release from a single workflow_dispatch button
• d8d9cdd README: add a sponsor badge
• ac70da6 README: dark-mode logo and a docs badge
• 23db51a junit: support ReportEntry
• b9e3bdd v2.32.2
• c6792b0 fix bug where ginkgo -race -p was taking extra long to exit
• See full diff in compare view

Updates github.com/onsi/gomega from 1.43.0 to 1.43.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.43.1

Maintenance

• Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.43.1

Maintenance

• Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]

Commits

• 1fca5c2 v1.43.1
• 47f0f87 v1.43.1 (full)
• be53601 changelog: entries for the yaml bump and the release flow
• e06b67c fix(ci): strip the tests with a find that works on GNU find too
• e9dc84d ci: release from a single workflow_dispatch button
• d547015 dependencies: bump go.yaml.in/yaml/v3 v3.0.4 -> v3.0.5
• 3ca97d6 README: add a sponsor badge
• 92bd34a README: dark-mode logo and a docs badge
• See full diff in compare view

Updates github.com/prometheus/alertmanager from 0.34.0 to 0.34.1

Release notes

Sourced from github.com/prometheus/alertmanager's releases.

0.34.1 / 2026-09-17

• [BUGFIX] inhibit: Fix several issues related to inhibitions that caused alerts to be improperly un-muted in some cases. #5542, #5449, #5559

Changelog

Sourced from github.com/prometheus/alertmanager's changelog.

0.34.1 / 2026-09-17

• [BUGFIX] inhibit: Fix several issues related to inhibitions that caused alerts to be improperly un-muted in some cases. #5542, #5449, #5559

Commits

• 73c6bfe Update release date
• 343df1d chore(deps): bump google.golang.org/grpc from v1.82.1 to v1.83.1
• 49be2ca update VERSION and CHANGELOG
• 98bb307 inhibitor: merge cache and index so there's only one lock (#5559)
• 3dfbc66 inhibit: add tests for source alerts sharing equal labels (#5449)
• 5e0f2e2 update inhibitor index to store all matched alerts (#5542)
• 7a2f950 chore(deps): bump golang.org/x/mod from v0.38.0 to v0.40.0 (#5468)
• See full diff in compare view

Updates github.com/tus/tusd/v2 from 2.10.0 to 2.10.1

Release notes

Sourced from github.com/tus/tusd/v2's releases.

v2.10.1

What's Changed

• handler: Enforce MaxSize on IETF draft upload creates by @​Acconut in tus/tusd#1397
• handler: Enforce MaxSize for deferred uploads with Content-Length by @​Acconut in tus/tusd#1396
• s3store: Fix silent truncation of deferred-length uploads by @​abh in tus/tusd#1385
• Update dependencies

New Contributors

• @​ollie-sutton made their first contribution in tus/tusd#1392

Full Changelog: tus/tusd@v2.10.0...v2.10.1

Commits

• 388a27c handler: enforce MaxSize on IETF draft upload creates (#1397)
• fb47346 handler: enforce MaxSize for deferred uploads with Content-Length (#1396)
• 1b9d53d s3store: fix silent truncation of deferred-length uploads (#1385)
• 66ebacb chore: Update dependencies to fix known CVEs (#1392)
• 7fde323 e2e: Install MinIO from source instead of Docker Hub (#1395)
• 8d97ac7 e2e: Allow Go 1.27 shutdown exit delay in TestShutdown (#1394)
• b1b4729 build(deps): bump the gha group with 6 updates (#1388)
• 3caa902 build(deps): bump the go group across 1 directory with 13 updates (#1391)
• 2c5d32f build(deps): bump golang in the docker group (#1387)
• ad7fb31 build(deps): bump the gha group with 2 updates (#1383)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.56.0 to 0.57.0

Commits

• 3f62bf1 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates golang.org/x/exp from 0.0.0-20260410095643-746e56fc9e2f to 0.0.0-20260611194520-c48552f49976

Commits

• See full diff in compare view

Updates golang.org/x/oauth2 from 0.36.0 to 0.37.0

Commits

• c624b89 google: change the snake case endpoint to kebab-case
• 09a82f6 all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view

Updates golang.org/x/sync from 0.22.0 to 0.23.0

Commits

• f75267d semaphore: panic on negative capacity
• 3ffd83c all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view

Updates golang.org/x/sys from 0.47.0 to 0.48.0

Commits

• 613e257 cpu: add riscv64 hwprobe drift test
• 6f7b10f unix: add MLOCK_ONFAULT constant
• 663e7c8 cpu: add basic support for GOARCH=sparc64
• de5f12f cpu: add ppc64le POWER10 detection
• 80e8acf unix: run go fix
• 1e3c182 unix: add IPMI interface
• d429e20 unix: stop generating sparc termbits from the generic header
• bd3bddf unix: add missing HWTSTAMP_* constants
• e812f53 windows: add SO_SNDTIMEO constant for socket options
• f6989c5 unix: align Ifreq so its union accessors cannot fault
• Additional commits viewable in compare view

Updates golang.org/x/term from 0.45.0 to 0.46.0

Commits

• 6226200 go.mod: update golang.org/x dependencies
• 7c2fb74 term: process bytes returned with a read error
• 3963fce all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view

Updates golang.org/x/text from 0.41.0 to 0.42.0

Commits

• fafe4a0 go.mod: update golang.org/x dependencies
• f53c316 unicode/norm: don't truncate runes in the recomposition map key
• 37867f6 unicode/norm: let any starter block composition in compose
• 0dd525f unicode/norm: compose non-Hangul runes after a Hangul syllable
• bac26e5 unicode/norm: avoid improper ErrShortDst return in Form.transform
• 4f55186 unicode/norm: simplify short source detection in Form.transform
• a1b6c10 unicode/norm: prevent decomposeSegment from moving backwards
• cd1cbc9 unicode/bidi: panic rather than log.Panicf
• a459614 internal/export/idna: fix conformance with optional validation disabled
• be70a61 internal/export/idna: drop trie field from Profiles
• Additional commits viewable in compare view

Updates google.golang.org/genproto from 0.0.0-20260319201613-d00831a3d3e7 to 0.0.0-20260622175928-b703f567277d

Commits

• See full diff in compare view

Updates google.golang.org/grpc from 1.83.2 to 1.84.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.84.0

Behavior Changes

• stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

• xds: Add support for contains_match in route header matchers. (#9223)
  • Special Thanks: @​nvxbug

Bug Fixes

• client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)
  • Special Thanks: @​utkuozdemir
• client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)
  • Special Thanks: @​chengxilo
• credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)
  • Special Thanks: @​buger
• credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)
  • Special Thanks: @​nvxbug
• randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)
  • Special Thanks: @​fallintoplace
• stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)
• transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)
  • Special Thanks: @​buger
• transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)
  • Special Thanks: @​buger
• xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#9140)
• xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#9223)
  • Special Thanks: @​nvxbug
• xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#9223)
  • Special Thanks: @​nvxbug
• xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#9257)
  • Special Thanks: @​nvxbug
• xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#9218)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#9250)
  • Special Thanks: @​nvxbug

Performance Improvements

• transport: Avoid a heap allocation when flushing shared write buffers. (#9233)
  • Special Thanks: @​zaidoon1
• credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)

Commits

• e84aa5a Change version to 1.84.0 (#9324)
• c5ae88d Cherrypick #9204 and #9321 to v1.84.x (#9407)
• a592f6a Cherrypick #9351 and #9404 to v1.84.x (#9408)
• d5a4111 cherry-pick #9365 to v1.84.x (#9370)
• 89d55e0 cherry-pick #9346 to v1.84.x (#9372)
• 8a9f866 Cherry-pick #9332 to v1.84.x (#9338)
• f8b54e7 Cherry-pick #9331 to v1.84.x (#9334)
• 30ce1d5 xds: support injecting bootstrap and server config into HTTP filter config pa...
• 54c743e extproc : wait for async RPC to complete in test (#9311)
• 538bb2f endpointsharding: decouple locking, and simplify ChildState API (#9290)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.