Skip to content

Bump the go_modules group across 1 directory with 10 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
trunkfrom
dependabot/go_modules/go_modules-05d6f397b7
Open

Bump the go_modules group across 1 directory with 10 updates#1
dependabot[bot] wants to merge 1 commit into
trunkfrom
dependabot/go_modules/go_modules-05d6f397b7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 18, 2026

Copy link
Copy Markdown

Bumps the go_modules group with 6 updates in the / directory:

Package From To
github.com/cli/go-gh/v2 2.12.0 2.12.1
golang.org/x/crypto 0.35.0 0.45.0
google.golang.org/grpc 1.69.4 1.79.3
github.com/docker/cli 27.5.0+incompatible 29.2.0+incompatible
github.com/in-toto/in-toto-golang 0.9.0 0.11.0
github.com/sigstore/rekor 1.3.8 1.5.0

Updates github.com/cli/go-gh/v2 from 2.12.0 to 2.12.1

Release notes

Sourced from github.com/cli/go-gh/v2's releases.

v2.12.1

Security

A security vulnerability has been identified in go-gh where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing.

For more information, see GHSA-g9f5-x53j-h563

Full Changelog: cli/go-gh@v2.12.0...v2.12.1

Commits
  • a08820a Merge commit from fork
  • 1ecf6c4 Expand test cases for schem case sensitivity
  • 56c6f10 Parse and examine URL, assume scheme if missing
  • 055ff21 PR feedback
  • 258949b Test refactor, refine errors, remove VSCode fix
  • 0f8a22f Enhance OS-specific browser tests, PR feedback
  • df956a6 Initial fix for browsing URLs
  • See full diff in compare view

Updates golang.org/x/crypto from 0.35.0 to 0.45.0

Commits
  • 4e0068c go.mod: update golang.org/x dependencies
  • e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
  • f91f7a7 ssh/agent: prevent panic on malformed constraint
  • 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
  • bcf6a84 acme: pass context to request
  • b4f2b62 ssh: fix error message on unsupported cipher
  • 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
  • 122a78f go.mod: update golang.org/x dependencies
  • c0531f9 all: eliminate vet diagnostics
  • 0997000 all: fix some comments
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.69.4 to 1.79.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

  • server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

  • stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

  • mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)
  • experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

  • balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

  • experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)
  • pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
    • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)
  • xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)
  • balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Bug Fixes

  • credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)
  • xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)
  • health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)
  • transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)
  • server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Performance Improvements

  • credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)
  • mem: Optimize pooling and creation of buffer objects. (#8784)
  • transport: Reduce slice re-allocations by reserving slice capacity. (#8797)

... (truncated)

Commits

Updates github.com/docker/cli from 27.5.0+incompatible to 29.2.0+incompatible

Commits
  • 0b9d198 Merge pull request #6764 from vvoland/update-docker
  • 9c9ec73 vendor: github.com/moby/moby/client v0.2.2
  • bab3e81 vendor: github.com/moby/moby/api v1.53.0
  • 2e64fc1 Merge pull request #6367 from thaJeztah/template_slicejoin
  • 1f2ba2a Merge pull request #6760 from thaJeztah/container_create_fix_error
  • e34a342 templates: make "join" work with non-string slices and map values
  • a86356d Merge pull request #6763 from thaJeztah/bump_mapstructure
  • 771660a vendor: github.com/go-viper/mapstructure/v2 v2.5.0
  • 9cff36b Merge pull request #6762 from thaJeztah/bump_x_deps
  • 08ed2bc cli/command/container: make injecting config.json failures a warning
  • Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.0.5 to 4.1.3

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.3

This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop x/crypto and no longer have any external dependencies in go-jose outside of the standard library!

This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.

What's Changed

Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3

v4.1.2

What's Changed

go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.

New Contributors

Full Changelog: go-jose/go-jose@v4.1.1...v4.1.2

v4.1.1

What's Changed

New Contributors

Full Changelog: go-jose/go-jose@v4.1.0...v4.1.1

v4.1.0

What's Changed

... (truncated)

Commits

Updates github.com/in-toto/in-toto-golang from 0.9.0 to 0.11.0

Release notes

Sourced from github.com/in-toto/in-toto-golang's releases.

v0.11.0

What's Changed

Full Changelog: in-toto/in-toto-golang@v0.10.0...v0.11.0

v0.10.0

What's Changed

... (truncated)

Commits
  • 36d782f Merge pull request #462 from in-toto/fix-negation-character
  • 4a09e3b match: Replace ^ with ! for negation in character classes
  • c3302e8 Merge pull request #459 from in-toto/dependabot/go_modules/github.com/go-jose...
  • 016e87e chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
  • 5b9df76 Merge pull request #457 from in-toto/dependabot/go_modules/google.golang.org/...
  • 595b3fe chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3
  • e396d24 Merge pull request #452 from in-toto/dependabot/github_actions/all-502588e1ca
  • 142b779 Merge pull request #453 from in-toto/dependabot/go_modules/all-d8ef5820aa
  • f741bcc chore(deps): bump the all group with 2 updates
  • c374dc9 chore(deps): bump the all group across 1 directory with 2 updates
  • Additional commits viewable in compare view

Updates github.com/sigstore/rekor from 1.3.8 to 1.5.0

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.5.0

This release fixes GHSA-273p-m2cw-6833 and GHSA-4c4x-jm2x-pf9j. Note that this drops support for fetching public keys via URL when querying the search API.

Vulnerability Fixes

  • Handle malformed COSE and DSSE entries (#2729)
  • Drop support for fetching public keys by URL in the search index (#2731)

Features

  • Add support for a custom TLS config for clients (#2709)

v1.4.3

This release reduces dependencies for a number of exported packages.

This release also changes the format of the binary and container signature, which is now a Sigstore bundle. To verify a release, use the latest Cosign 3.x, verifying with cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>.

Improvements

  • use interruptable context to elegantly handle signals in rekor-cli (#2681)
  • restapi: Don't log client errors as errors (#2680)
  • pkg: separate pki types from implementations (#2668)
  • e2e: don't mix e2e and regular utilities (#2672)
  • pkg: remove viper config from spec definitions (#2669)
  • log: remove zap & go-chi dependecy from pkg/types (#2667)
  • chore: update go-openapi/runtime to v0.29.0 (#2670)
  • chore: remove double imported mapstructure pkg (#2671)
  • remove archived dependency and use stdlib slices (#2650)

Documentation

  • (docs): guard unsafe int/uint conversions flagged by gosec (#2679)

Contributors

  • AdamKorcz
  • Bob Callaway
  • Jussi Kukkonen
  • Sachin Sampras M
  • Tõnis Tiigi

v1.4.2

What's Changed

... (truncated)

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.5.0

This release fixes GHSA-273p-m2cw-6833 and GHSA-4c4x-jm2x-pf9j. Note that this drops support for fetching public keys via URL when querying the search API.

Vulnerability Fixes

  • Handle malformed COSE and DSSE entries (#2729)
  • Drop support for fetching public keys by URL in the search index (#2731)

Features

  • Add support for a custom TLS config for clients (#2709)

v1.4.3

This release reduces dependencies for a number of exported packages.

This release also changes the format of the binary and container signature, which is now a Sigstore bundle. To verify a release, use the latest Cosign 3.x, verifying with cosign verify-blob --bundle <artifact>-keyless.sigstore.json <artifact>.

Improvements

  • use interruptable context to elegantly handle signals in rekor-cli (#2681)
  • restapi: Don't log client errors as errors (#2680)
  • pkg: separate pki types from implementations (#2668)
  • e2e: don't mix e2e and regular utilities (#2672)
  • pkg: remove viper config from spec definitions (#2669)
  • log: remove zap & go-chi dependecy from pkg/types (#2667)
  • chore: update go-openapi/runtime to v0.29.0 (#2670)
  • chore: remove double imported mapstructure pkg (#2671)
  • remove archived dependency and use stdlib slices (#2650)

Documentation

  • (docs): guard unsafe int/uint conversions flagged by gosec (#2679)

Contributors

  • AdamKorcz
  • Bob Callaway
  • Jussi Kukkonen
  • Sachin Sampras M
  • Tõnis Tiigi

v1.4.2

This release includes some performance optimizations and a bug fix for publishing events to a pub/sub topic.

... (truncated)

Commits
  • fe9717f Changelog for v1.5.0 (#2730)
  • 60ef2bc Drop support for fetching public keys by URL in the search index (#2731)
  • ca625dc build(deps): Bump github.com/redis/go-redis/v9 from 9.14.1 to 9.17.2 (#2706)
  • 39bae3d Merge commit from fork (#2729)
  • 812e699 build(deps): Bump google.golang.org/api from 0.256.0 to 0.259.0 (#2723)
  • 4596e4e build(deps): Bump golang.org/x/net from 0.47.0 to 0.48.0 (#2722)
  • a3e73cd build(deps): Bump github.com/sigstore/sigstore from 1.9.5 to 1.10.3 (#2724)
  • 94d259c build(deps): Bump the all group across 1 directory with 3 updates (#2727)
  • a5329c9 build(deps): Bump the all group with 2 updates (#2728)
  • 5e6bdcd build(deps): Bump google.com/cloudsdktool/google-cloud-cli (#2726)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.8.12 to 1.10.3

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.10.3

What's Changed

v1.10.3 adds ValidatePubKey back to the cryptoutils package to avoid a breaking API change.

Full Changelog: sigstore/sigstore@v1.10.2...v1.10.3

v1.10.2

Functionally equivalent to v1.10.0. v1.10.1 has been retracted to remove copied code.

v1.10.0

Breaking change

sigstore/sigstore#2194 moves cryptoutils.ValidatePubKey to goodkey.ValidatePubKey to minimize the dependency tree for clients using the cryptoutils package.

Features

Refactoring

v1.10.0

Breaking change

sigstore/sigstore#2194 moves cryptoutils.ValidatePubKey to goodkey.ValidatePubKey to minimize the dependency tree for clients using the cryptoutils package.

Features

Refactoring

... (truncated)

Commits
  • 72f0ed7 build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2230)
  • b257168 build(deps): Bump github.com/aws/aws-sdk-go-v2 in /pkg/signature/kms/aws (#2226)
  • 84f57b8 build(deps): Bump github.com/sigstore/sigstore (#2221)
  • bdc1a86 build(deps): Bump actions/checkout from 5.0.1 to 6.0.0 (#2220)
  • 11dfe81 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/aws (#2236)
  • 0214948 Add back ValidatePubKey as a deprecated, minimal function (#2235)
  • cc26bb8 build(deps): Bump localstack/localstack in /test/e2e in the all group (#2227)
  • 63ab8d8 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2229)
  • 9e629f0 build(deps): Bump the all group with 2 updates (#2219)
  • 234b99d build(deps): Bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#2223)
  • Additional commits viewable in compare view

Updates go.mongodb.org/mongo-driver from 1.14.0 to 1.17.6

Release notes

Sourced from go.mongodb.org/mongo-driver's releases.

MongoDB Go Driver 1.17.6

The MongoDB Go Driver Team is pleased to release version 1.17.6 of the official MongoDB Go Driver.

[!NOTE] Due to a bug in the Go Driver release automation, there is no 1.17.5 release.

Release Highlights

This release makes various maintainability improvements to the Go Driver development and release automation.

What's Changed

📝 Other Changes

Full Changelog: mongodb/mongo-go-driver@v1.17.4...v1.17.6

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 1.17.4

The MongoDB Go Driver Team is pleased to release version 1.17.4 of the official MongoDB Go Driver.

Release Notes

This release resolves two bugs in the Go Driver: it removes a buggy and unnecessary connection liveness check that could run unexpectedly or fail intermittently when maxIdleTimeMS was set, and it fixes an issue where regular expressions were marshaled to invalid JSON due to improper character escaping, ensuring all generated JSON is now valid.

For a full list of tickets included in this release, please see the list of fixed issues.

Full Changelog: v1.17.3...v1.17.4

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. Questions and inquiries can be asked on the MongoDB Developer Community. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

What's Changed

... (truncated)

Commits
  • d2fa0ab BUMP v1.17.6
  • f1d540b BUMP v1.17.5
  • b879028 GODRIVER-3654 Don't test v1 branches against latest server. (#2188)
  • 21f47d4 Allow ignore-for-release label to satisfy label checker (#2203)
  • 8708ca8 Disable merge-up from release/1.17 (#2202)
  • 0b2794f GODRIVER-3612 Add an internal-only NewSessionWithLSID API (v1) (#2183)
  • 747a8d0 Consider HTTP 429 a succcessful response in the Markdown link check. (#2191)
  • 8c336ff Pin drivers-evergreen-tools to rev 98f6b0e in v1. (#2184)
  • 106cff3 Retry Markdown link checks on HTTP 429 (v1) (#2186)
  • d406474 GODRIVER-3564: Add config and workflows for release note labels (#2148)
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.36.0 to 0.48.0

Commits
  • 35e1306 go.mod: update golang.org/x dependencies
  • 7c36036 http2, webdav, websocket: fix %q verb uses with wrong type
  • ec11ecc trace: fix data race in RenderEvents
  • bff14c5 http2: don't PING a responsive server when resetting a stream
  • 88a6421 dns/dnsmessage: avoid use of "strings" and "math" in dns/dnsmessage
  • 123d099 http2: support net/http.Transport.NewClientConn
  • 346cc61 webdav: relax test to check for any redirect status, not just 301
  • 9a29643 go.mod: update golang.org/x dependencies
  • 07cefd8 context: deprecate
  • 5ac9dac publicsuffix: don't treat ip addresses as domain names
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made t...

Description has been truncated

@dependabot
Bump the go_modules group across 1 directory with 10 updates
a402341 
Bumps the go_modules group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/cli/go-gh/v2](https://github.com/cli/go-gh) | `2.12.0` | `2.12.1` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.35.0` | `0.45.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.69.4` | `1.79.3` |
| [github.com/docker/cli](https://github.com/docker/cli) | `27.5.0+incompatible` | `29.2.0+incompatible` |
| [github.com/in-toto/in-toto-golang](https://github.com/in-toto/in-toto-golang) | `0.9.0` | `0.11.0` |
| [github.com/sigstore/rekor](https://github.com/sigstore/rekor) | `1.3.8` | `1.5.0` |



Updates `github.com/cli/go-gh/v2` from 2.12.0 to 2.12.1
- [Release notes](https://github.com/cli/go-gh/releases)
- [Commits](cli/go-gh@v2.12.0...v2.12.1)

Updates `golang.org/x/crypto` from 0.35.0 to 0.45.0
- [Commits](golang/crypto@v0.35.0...v0.45.0)

Updates `google.golang.org/grpc` from 1.69.4 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.69.4...v1.79.3)

Updates `github.com/docker/cli` from 27.5.0+incompatible to 29.2.0+incompatible
- [Commits](docker/cli@v27.5.0...v29.2.0)

Updates `github.com/go-jose/go-jose/v4` from 4.0.5 to 4.1.3
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.0.5...v4.1.3)

Updates `github.com/in-toto/in-toto-golang` from 0.9.0 to 0.11.0
- [Release notes](https://github.com/in-toto/in-toto-golang/releases)
- [Changelog](https://github.com/in-toto/in-toto-golang/blob/master/CHANGELOG.md)
- [Commits](in-toto/in-toto-golang@v0.9.0...v0.11.0)

Updates `github.com/sigstore/rekor` from 1.3.8 to 1.5.0
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.3.8...v1.5.0)

Updates `github.com/sigstore/sigstore` from 1.8.12 to 1.10.3
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.8.12...v1.10.3)

Updates `go.mongodb.org/mongo-driver` from 1.14.0 to 1.17.6
- [Release notes](https://github.com/mongodb/mongo-go-driver/releases)
- [Commits](mongodb/mongo-go-driver@v1.14.0...v1.17.6)

Updates `golang.org/x/net` from 0.36.0 to 0.48.0
- [Commits](golang/net@v0.36.0...v0.48.0)

---
updated-dependencies:
- dependency-name: github.com/cli/go-gh/v2
  dependency-version: 2.12.1
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/docker/cli
  dependency-version: 29.2.0+incompatible
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.3
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/in-toto/in-toto-golang
  dependency-version: 0.11.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/sigstore/rekor
  dependency-version: 1.5.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.10.3
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: go.mongodb.org/mongo-driver
  dependency-version: 1.17.6
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-version: 0.48.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants