Skip to content

Update Go Dependencies - #126

Open
red-hat-konflux[bot] wants to merge 1 commit into
tech-previewfrom
konflux/mintmaker/tech-preview/go-deps
Open

Update Go Dependencies#126
red-hat-konflux[bot] wants to merge 1 commit into
tech-previewfrom
konflux/mintmaker/tech-preview/go-deps

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending
github.com/ThalesGroup/crypto11 require patch v1.6.2 → v1.6.8
github.com/cenkalti/backoff/v5 indirect major v5.0.3 → v7.0.1
github.com/coreos/go-oidc/v3 require minor v3.20.0 → v3.21.0
github.com/digitorus/pkcs7 indirect digest ffadbf3 → d678ea5
github.com/digitorus/timestamp indirect digest c455327 → b4b58b9
github.com/go-jose/go-jose/v4 indirect patch v4.1.4 → v4.1.5
github.com/go-logr/logr indirect patch v1.4.3 → v1.4.4
github.com/go-openapi/analysis indirect major v0.25.3 → v1.0.1
github.com/go-openapi/errors indirect patch v0.22.8 → v0.22.9
github.com/go-openapi/jsonpointer indirect patch v1.0.0 → v1.0.2
github.com/go-openapi/jsonreference indirect patch v1.0.0 → v1.0.3
github.com/go-openapi/loads indirect minor v0.24.0 → v0.25.3
github.com/go-openapi/runtime indirect minor v0.32.5 → v0.33.3
github.com/go-openapi/runtime/server-middleware indirect minor v0.32.5 → v0.33.3
github.com/go-openapi/spec indirect major v0.22.6 → v1.0.1
github.com/go-openapi/strfmt indirect patch v0.27.0 → v0.27.3
github.com/go-openapi/swag indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/cmdutils indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/conv indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/fileutils indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/jsonname indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/jsonutils indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/loading indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/mangling indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/netutils indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/stringutils indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/typeutils indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/swag/yamlutils indirect minor v0.27.0 → v0.29.2
github.com/go-openapi/validate indirect major v0.26.0 → v1.0.0
github.com/google/go-containerregistry require minor v0.21.7 → v0.22.1
github.com/grpc-ecosystem/grpc-gateway/v2 indirect minor v2.29.0 → v2.31.0
github.com/oklog/ulid/v2 indirect patch v2.1.1 → v2.1.2
github.com/secure-systems-lab/go-securesystemslib indirect patch v0.11.0 → v0.11.1
github.com/sigstore/protobuf-specs require patch v0.5.1 → v0.5.2
github.com/sigstore/rekor indirect patch v1.5.3 → v1.5.4
github.com/sigstore/sigstore require minor v1.10.8 → v1.11.0
github.com/sigstore/sigstore-go require minor v1.2.2 → v1.3.0
github.com/sigstore/timestamp-authority/v2 indirect patch v2.1.3 → v2.1.4
github.com/theupdateframework/go-tuf indirect major v0.7.0 → v2.4.2
go.opentelemetry.io/otel require minor v1.44.0 → v1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace indirect minor v1.44.0 → v1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp require minor v1.44.0 → v1.47.0
go.opentelemetry.io/otel/metric indirect minor v1.44.0 → v1.47.0
go.opentelemetry.io/otel/sdk require minor v1.44.0 → v1.47.0
go.opentelemetry.io/otel/trace require minor v1.44.0 → v1.47.0
go.opentelemetry.io/proto/otlp indirect minor v1.10.0 → v1.11.1
go.yaml.in/yaml/v3 indirect patch v3.0.4 → v3.0.5
golang.org/x/crypto require minor v0.54.0 → v0.57.0 v0.58.0
golang.org/x/mod indirect minor v0.38.0 → v0.41.0 v0.42.0
golang.org/x/net indirect minor v0.57.0 → v0.59.0 v0.61.0 (+1)
golang.org/x/oauth2 require minor v0.36.0 → v0.37.0
golang.org/x/sync indirect minor v0.22.0 → v0.24.0
golang.org/x/sys indirect minor v0.47.0 → v0.49.0
golang.org/x/term indirect minor v0.45.0 → v0.46.0 v0.47.0
golang.org/x/text indirect minor v0.40.0 → v0.42.0 v0.43.0
google.golang.org/genproto/googleapis/api indirect digest e75dac1 → fad4113
google.golang.org/genproto/googleapis/rpc indirect digest e75dac1 → fad4113
google.golang.org/grpc indirect minor v1.82.1 → v1.84.0
google.golang.org/protobuf require patch v1.36.11 → v1.36.12
sigs.k8s.io/release-utils require patch v0.12.4 → v0.12.5

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

ThalesGroup/crypto11 (github.com/ThalesGroup/crypto11)

v1.6.8

Compare Source

What's Changed

  • downgrade the go version to 1.25.0 and add go toolchain by @​Nicolas-Peiffer in eclipse-keypont#139
  • fix: restore eclipse-keypont module path; refresh README install command, Go Reference badge and documentation links

Full Changelog: eclipse-keypont/crypto11@v1.6.5...v1.6.8

Module path restored — github.com/eclipse-keypont/crypto11

This release restores the correct module path following the repository move from
github.com/ThalesGroup/crypto11 to github.com/eclipse-keypont/crypto11.

Migrating
go get github.com/eclipse-keypont/crypto11@v1.6.8
-import "github.com/ThalesGroup/crypto11"
+import "github.com/eclipse-keypont/crypto11"

The old path is deprecated and frozen at
ThalesGroup/crypto11@v1.6.7.
It will receive no further updates, including security fixes. GitHub still redirects the old
repository URL, but the Go module path must be updated by hand — go get cannot follow it for you.

If you are already on this path: upgrade v1.6.5 → v1.6.8

v1.6.6 and v1.6.7 declare the old module path and exist only to publish the deprecation
notice for github.com/ThalesGroup/crypto11. They are not usable as
github.com/eclipse-keypont/crypto11 and will fail with:

module declares its path as: github.com/ThalesGroup/crypto11
        but was required as: github.com/eclipse-keypont/crypto11

v1.6.8 fixes this, so github.com/eclipse-keypont/crypto11@latest resolves correctly again.

Go version policy

go.mod targets go 1.25.0 with toolchain go1.25.8. The go directive is kept conservative
so this library does not raise the minimum Go version for projects that import it, while
maintainers build and test with the latest patch toolchain. See #​137 and #​139.

The v1.6.x series is the current stable line. v2.x.y on github.com/eclipse-keypont/crypto11/v2 is in
development (v2.0.0-rc3), which is why pkg.go.dev reports a higher tagged major version.

v1.6.7

Compare Source

v1.6.6

Compare Source

v1.6.5

Compare Source

Full Changelog: eclipse-keypont/crypto11@v1.6.3...v1.6.5

v1.6.4

Compare Source

v1.6.3

Compare Source

cenkalti/backoff (github.com/cenkalti/backoff/v5)

v7.0.1

Compare Source

v7.0.0

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

coreos/go-oidc (github.com/coreos/go-oidc/v3)

v3.21.0

Compare Source

What's Changed

  • oidc: ignore JWKs with unsupported key types rather than failing by @​nicoske in #​499

New Contributors

Full Changelog: coreos/go-oidc@v3.20.0...v3.21.0

go-jose/go-jose (github.com/go-jose/go-jose/v4)

v4.1.5

Compare Source

Fixed security issues

  • cipher/cbc_hmac: don't panic on empty ciphertext (#​292)
  • cipher/cbc_hmac: don't panic on invalid key (#​291)
  • json: limit stack depth (#​290)
  • jwt: reject out-of-range NumericDate values (#​278)
  • Check alg against pubkey curve during verify. (#​293)
  • Reject malformed Ed25519 JWKs (#​250)
  • jws: choose verification key per-signature (#​243)

Breaking Changes

In #​226, we un-exported jose.RandReader. This was used to be able to stub out the randomness function in tests, but is ignored as of Go 1.26 in some APIs, so no longer serves a useful function.

Changed

  • Verify OpaqueSigner's Public() return is public (#​260)
  • jws: skip signature on ErrJWKSKidNotFound (#​248)
  • Handle JWE JSON without protected header (#​240)
  • jws: don't strip internal whitespace before parsing JSON (#​239)
  • jws: fewer calls to OpaqueSigner.Public() (#​224)
  • Return a specific error when parsing empty string (#​216)
  • Reject typed nil at Verify time (#​285)
go-logr/logr (github.com/go-logr/logr)

v1.4.4

Compare Source

What's Changed

New Contributors

Full Changelog: go-logr/logr@v1.4.3...v1.4.4

go-openapi/analysis (github.com/go-openapi/analysis)

v1.0.1

Compare Source

1.0.1 - 2026-10-04

Full Changelog: go-openapi/analysis@v1.0.0...v1.0.1

8 commits in this release.

Fixed bugs
  • fix(diff): compare MaxLength, not MinLength, in CheckStringTypeChanges by @​martel in #​253 ...
Documentation
Miscellaneous tasks
Updates
People who contributed to this release
New Contributors

analysis license terms

License

Per-module changes

internal/testintegration (1.0.1)

Miscellaneous tasks
Updates

v1.0.0

Compare Source

1.0.0 - 2026-09-03

Full Changelog: go-openapi/analysis@v0.26.2...v1.0.0

5 commits in this release.

Documentation
Miscellaneous tasks
Updates
People who contributed to this release

analysis license terms

License

Per-module changes

internal/testintegration (1.0.0)

Miscellaneous tasks
Updates

v0.26.2

Compare Source

0.26.2 - 2026-08-25

Full Changelog: go-openapi/analysis@v0.26.1...v0.26.2

2 commits in this release.

Fixed bugs
Miscellaneous tasks
People who contributed to this release

analysis license terms

License

Per-module changes

internal/testintegration (0.26.2)

Fixed bugs
Miscellaneous tasks

v0.26.1

Compare Source

0.26.1 - 2026-08-24

Full Changelog: go-openapi/analysis@v0.26.0...v0.26.1

16 commits in this release.

Fixed bugs
  • fix: upgraded spec to onboard expand fixes by @​fredbi ...
  • fix(flatten): import the target of a $ref held by an unmapped keyword by @​fredbi ...
Documentation
Testing
  • test: rename fixtures directories to testdata by @​fredbi ...
Miscellaneous tasks
Updates
Other (technical)
People who contributed to this release

analysis license terms

License

Per-module changes

internal/testintegration (0.26.1)

Fixed bugs
Testing
  • test: rename fixtures directories to testdata by @​fredbi ...
Miscellaneous tasks
Updates
Other (technical)

v0.26.0

Compare Source

0.26.0 - 2026-08-08

Full Changelog: go-openapi/analysis@v0.25.5...v0.26.0

7 commits in this release.

Implemented enhancements
Documentation
Miscellaneous tasks
Updates
People who contributed to this release

analysis license terms

License

Per-module changes

internal/testintegration (0.26.0)

Miscellaneous tasks
Updates

v0.25.5

Compare Source

0.25.5 - 2026-07-20

Full Changelog: go-openapi/analysis@v0.25.4...v0.25.5

1 commits in this release.

Code quality
  • fix(flatten): in options, guarded against possible json serialization of by @​fredbi in #​221 ...
People who contributed to this release

analysis license terms

License

v0.25.4

Compare Source

0.25.4 - 2026-07-20

Full Changelog: go-openapi/analysis@v0.25.3...v0.25.4

8 commits in this release.

Implemented enhancements
  • feat: inject a confined document loader into flatten and schema analysis by @​fredbi in #​220 ...
Documentation
Updates
Other (technical)
People who contributed to this release

analysis license terms

License

Per-module changes

internal/testintegration (0.25.4)

Implemented enhancements
  • feat: inject a confined document loader into flatten and schema analysis by @​fredbi in #​220 ...
Updates
go-openapi/errors (github.com/go-openapi/errors)

v0.22.9

Compare Source

0.22.9 - 2026-09-12

Full Changelog: go-openapi/errors@v0.22.8...v0.22.9

22 commits in this release.

Documentation
Miscellaneous tasks
Updates
People who contributed to this release

errors license terms

License

go-openapi/jsonpointer (github.com/go-openapi/jsonpointer)

v1.0.2

Compare Source

1.0.2 - 2026-09-24

Full Changelog: go-openapi/jsonpointer@v1.0.1...v1.0.2

7 commits in this release.

Fixed bugs
  • fix: panics in Pointer.Get, Pointer.Set and json name resolution by @​fredbi ...
Documentation
Code quality
Updates
  • build(deps): bump github.com/go-openapi/testify/v2 from 2.7.0 to 2.8.0 in the go-openapi-dependencies group by @​dependabot[bot] in #​157 ...
  • build(deps): bump the development-dependencies group with 9 updates by [@​dependabot[bot]](https://

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/tech-preview/go-deps branch 16 times, most recently from 0f390a8 to 458fe50 Compare July 27, 2026 21:05
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/tech-preview/go-deps branch 12 times, most recently from 4d7e53d to 34c56d1 Compare August 1, 2026 11:14
@red-hat-konflux

red-hat-konflux Bot commented Aug 1, 2026

Copy link
Copy Markdown
Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d -> v0.0.0-20260720211330-0afa2a65878a
google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d -> v0.0.0-20260720211330-0afa2a65878a

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/tech-preview/go-deps branch 12 times, most recently from 5883c7c to bbfb934 Compare August 10, 2026 07:04
@red-hat-konflux red-hat-konflux Bot changed the title Update Go Dependencies chore(deps): update go dependencies Aug 11, 2026
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/tech-preview/go-deps branch from bbfb934 to 2103bd7 Compare August 12, 2026 04:00
@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update go dependencies Update Go Dependencies Aug 12, 2026
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/tech-preview/go-deps branch from 2103bd7 to a1d9ed6 Compare August 12, 2026 06:29
@red-hat-konflux red-hat-konflux Bot changed the title Update Go Dependencies chore(deps): update go dependencies Aug 12, 2026
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/tech-preview/go-deps branch from a1d9ed6 to 45a1c2d Compare August 13, 2026 02:00
@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update go dependencies Update Go Dependencies Aug 13, 2026
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/tech-preview/go-deps branch 4 times, most recently from e313c25 to 398f713 Compare August 17, 2026 02:13
@red-hat-konflux red-hat-konflux Bot changed the title Update Go Dependencies chore(deps): update go dependencies Aug 17, 2026
@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update go dependencies Update Go Dependencies Aug 17, 2026
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/tech-preview/go-deps branch from 398f713 to 1951c60 Compare August 18, 2026 03:12
@red-hat-konflux red-hat-konflux Bot changed the title Update Go Dependencies chore(deps): update go dependencies Aug 19, 2026
@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update go dependencies Update Go Dependencies Aug 20, 2026
@red-hat-konflux red-hat-konflux Bot changed the title Update Go Dependencies chore(deps): update go dependencies Aug 22, 2026
@red-hat-konflux
Update Go Dependencies
a7d09d7 
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants