Skip to content

chore(deps): update go dependencies#386

Open
red-hat-konflux[bot] wants to merge 1 commit into
release-1.4from
konflux/mintmaker/release-1.4/go-deps
Open

chore(deps): update go dependencies#386
red-hat-konflux[bot] wants to merge 1 commit into
release-1.4from
konflux/mintmaker/release-1.4/go-deps

Conversation

@red-hat-konflux
Copy link
Copy Markdown

@red-hat-konflux red-hat-konflux Bot commented May 11, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
chainguard.dev/sdk require patch v0.1.54v0.1.55
cloud.google.com/go/iam indirect minor v1.9.0v1.11.0
cloud.google.com/go/kms indirect minor v1.29.0v1.31.0
cloud.google.com/go/security require minor v1.22.0v1.24.0
github.com/AzureAD/microsoft-authentication-library-for-go indirect patch v1.7.1v1.7.2
github.com/Masterminds/semver/v3 indirect minor v3.3.1v3.5.0
github.com/aws/aws-sdk-go indirect patch v1.55.7v1.55.8
github.com/aws/aws-sdk-go-v2 indirect patch v1.41.6v1.41.7
github.com/aws/aws-sdk-go-v2/config indirect patch v1.32.16v1.32.17
github.com/aws/aws-sdk-go-v2/credentials indirect patch v1.19.15v1.19.16
github.com/aws/aws-sdk-go-v2/feature/ec2/imds indirect patch v1.18.22v1.18.23
github.com/aws/aws-sdk-go-v2/internal/configsources indirect patch v1.4.22v1.4.23
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 indirect patch v2.7.22v2.7.23
github.com/aws/aws-sdk-go-v2/internal/v4a indirect patch v1.4.23v1.4.24
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding indirect patch v1.13.8v1.13.9
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url indirect patch v1.13.22v1.13.23
github.com/aws/aws-sdk-go-v2/service/kms indirect patch v1.51.0v1.51.1
github.com/aws/aws-sdk-go-v2/service/signin indirect patch v1.0.10v1.0.11
github.com/aws/aws-sdk-go-v2/service/sso indirect patch v1.30.16v1.30.17
github.com/aws/aws-sdk-go-v2/service/ssooidc indirect patch v1.35.20v1.35.21
github.com/aws/aws-sdk-go-v2/service/sts indirect patch v1.42.0v1.42.1
github.com/aws/smithy-go indirect patch v1.25.0v1.25.1
github.com/bmatcuk/doublestar/v4 indirect minor v4.9.1v4.10.0
github.com/clipperhouse/displaywidth indirect minor v0.10.0v0.11.0
github.com/clipperhouse/uax29/v2 indirect minor v2.6.0v2.7.0
github.com/fatih/color indirect minor v1.18.0v1.19.0
github.com/fsnotify/fsnotify require minor v1.9.0v1.10.1
github.com/go-jose/go-jose/v3 indirect major v3.0.5v4.1.4
github.com/go-viper/mapstructure/v2 indirect minor v2.4.0v2.5.0
github.com/golang-jwt/jwt/v5 indirect patch v5.3.0v5.3.1
github.com/googleapis/api-linter/v2 indirect minor v2.0.0v2.3.1
github.com/grpc-ecosystem/go-grpc-middleware require major v1.4.0v2.3.3
github.com/grpc-ecosystem/grpc-gateway/v2 indirect minor v2.27.3v2.29.0
github.com/grpc-ecosystem/grpc-gateway/v2 require minor v2.28.0v2.29.0
github.com/hashicorp/hcl indirect major v1.0.1-vault-7v2.24.0
github.com/letsencrypt/boulder indirect minor v0.20260420.0v0.20260512.0
github.com/mattn/go-isatty indirect patch v0.0.20v0.0.22
github.com/olekukonko/errors indirect minor v1.2.0v1.3.0
github.com/olekukonko/ll indirect patch v0.1.6v0.1.8
github.com/pelletier/go-toml/v2 indirect minor v2.2.4v2.3.1
github.com/sigstore/sigstore require patch v1.10.5v1.10.6
github.com/sigstore/sigstore/pkg/signature/kms/aws require patch v1.10.5v1.10.6
github.com/sigstore/sigstore/pkg/signature/kms/azure require patch v1.10.5v1.10.6
github.com/sigstore/sigstore/pkg/signature/kms/gcp require patch v1.10.5v1.10.6
github.com/sigstore/sigstore/pkg/signature/kms/hashivault require patch v1.10.5v1.10.6
github.com/tink-crypto/tink-go-awskms/v2 require major v2.1.0v3.0.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace indirect minor v1.42.0v1.43.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc indirect minor v1.42.0v1.43.0
go.step.sm/crypto require minor v0.77.9v0.81.0
go.uber.org/zap require minor v1.27.1v1.28.0
go.yaml.in/yaml/v2 indirect major v2.4.4v3.0.4
goa.design/goa/v3 require minor v3.23.4v3.26.0
golang.org/x/crypto indirect minor v0.50.0v0.51.0
golang.org/x/net indirect minor v0.53.0v0.54.0
golang.org/x/sys indirect minor v0.43.0v0.44.0
golang.org/x/term indirect minor v0.42.0v0.43.0
golang.org/x/text indirect minor v0.36.0v0.37.0
google.golang.org/api require minor v0.276.0v0.279.0
google.golang.org/genproto indirect digest 7cedc363700d41
google.golang.org/genproto/googleapis/api indirect digest 7cedc363700d41
google.golang.org/genproto/googleapis/api require digest 7cedc363700d41
google.golang.org/genproto/googleapis/rpc indirect digest 7cedc363700d41
google.golang.org/grpc indirect minor v1.80.0v1.81.1
google.golang.org/grpc require minor v1.80.0v1.81.1
google.golang.org/grpc/cmd/protoc-gen-go-grpc indirect patch v1.6.1v1.6.2

Warning

Some dependencies could not be looked up. Check the warning logs for more information.


Release Notes

chainguard-dev/sdk (chainguard.dev/sdk)

v0.1.55

Compare Source

Full Changelog: chainguard-dev/sdk@v0.1.54...v0.1.55

AzureAD/microsoft-authentication-library-for-go (github.com/AzureAD/microsoft-authentication-library-for-go)

v1.7.2

Compare Source

What's Changed

New Contributors

Full Changelog: AzureAD/microsoft-authentication-library-for-go@v1.7.1...v1.7.2

Masterminds/semver (github.com/Masterminds/semver/v3)

v3.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: Masterminds/semver@v3.4.0...v3.5.0

v3.4.0

Compare Source

There are a few changes in this release to highlight:

  1. Constraints now has a property IncludePrerelease. When set to true the Check and Validate methods will include prereleases.
  2. When an AND group has one constraint with a prerelease but more than one constraint then prereleases will be included. For example, >1.0.0-beta.1 < 2. In the past this would not have included prereleases because each constraint needed to have a prerelease. Now, only one constraint needs to have a prerelease. This is considered a long standing bug fix. Note, this does not carry across OR groups. For example, >1.0.0-beta.1 < 2 || > 3. In this case, prereleases will not be included when evaluating against >3.
  3. NewVersion coercion with leading "0"'s is restored. This can be disabled by setting the package level property CoerceNewVersion to false.

What's Changed

New Contributors

Full Changelog: Masterminds/semver@v3.3.1...v3.4.0

aws/aws-sdk-go (github.com/aws/aws-sdk-go)

v1.55.8

Compare Source

SDK Features
  • Mark the module and all packages as deprecated.
    • This SDK has entered end-of-support.
aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)

v1.41.7

Compare Source

Module Highlights

  • github.com/aws/aws-sdk-go-v2/service/ecs: v1.41.7
    • Documentation: Documentation only update for Amazon ECS.
  • github.com/aws/aws-sdk-go-v2/service/glue: v1.78.0
    • Feature: Adding View related fields to responses of read-only Table APIs.
  • github.com/aws/aws-sdk-go-v2/service/ivschat: v1.12.5
    • Documentation: Doc-only update. Changed "Resources" to "Key Concepts" in docs and updated text.
  • github.com/aws/aws-sdk-go-v2/service/rolesanywhere: v1.10.0
    • Feature: This release increases the limit on the roleArns request parameter for the *Profile APIs that support it. This parameter can now take up to 250 role ARNs.
  • github.com/aws/aws-sdk-go-v2/service/securityhub: v1.47.2
    • Documentation: Documentation updates for AWS Security Hub
aws/smithy-go (github.com/aws/smithy-go)

v1.25.1

Compare Source

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.25.1
    • Bug Fix: Fixed a memory leak in the LRU cache implementation used by some AWS services.
bmatcuk/doublestar (github.com/bmatcuk/doublestar/v4)

v4.10.0: Added WithNoHidden option

Compare Source

Added support for a WithNoHidden option to ignore hidden files in patterns that might unintentionally match them. For example, a .config directory would not be matched by * or recursed into by **, but would be matched by .* or recursed by .config/**.

Thanks to @​lukasngl for the initial PR and idea!

What's Changed

New Contributors

Full Changelog: bmatcuk/doublestar@v4.9.2...v4.10.0

v4.9.2: Fixed Handling of Paths With Meta Chars Using Alts

Compare Source

@​toga4 submitted a PR that fixed a small bug with the way paths were handled when the pattern used {alts}: if some part of the on-disk path that came before the {alt} included meta characters (say, a directory name that included the character ?), these meta characters were not escaped when they were passed back through the globbing routines. This caused doublestar to interpret them as actual meta characters, rather than a fixed-string path as it should have. Nice find, @​toga4 !

What's Changed

  • fix: escape meta characters in paths during brace expansion by @​toga4 in #​108

New Contributors

Full Changelog: bmatcuk/doublestar@v4.9.1...v4.9.2

clipperhouse/displaywidth (github.com/clipperhouse/displaywidth)

v0.11.0

Compare Source

clipperhouse/uax29 (github.com/clipperhouse/uax29/v2)

v2.7.0

Compare Source

fatih/color (github.com/fatih/color)

v1.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: fatih/color@v1.18.0...v1.19.0

fsnotify/fsnotify (github.com/fsnotify/fsnotify)

v1.10.1

Compare Source

Changes and fixes
  • inotify: don't remove sibling watches sharing a path prefix (#​754)

  • inotify, windows: don't rename sibling watches sharing a path prefix
    (#​755)

v1.10.0

Compare Source

This version of fsnotify needs Go 1.23.

Changes and fixes
  • inotify: improve initialization error message (#​731)

  • inotify: send Rename event if recursive watch is renamed (#​696)

  • inotify: avoid copying event buffers when reading names (#​741)

  • kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (#​748)

  • kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (#​740)

  • windows: fix nil pointer dereference in remWatch (#​736)

  • windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (#​709, #​749)

go-jose/go-jose (github.com/go-jose/go-jose/v3)

v4.1.4

Compare Source

What's Changed

Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8

Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4

v4.1.3

Compare Source

This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop x/crypto and no longer have any external dependencies in go-jose outside of the standard library!

This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.

What's Changed

Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3

v4.1.2

Compare Source

What's Changed

go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.

New Contributors

Full Changelog: go-jose/go-jose@v4.1.1...v4.1.2

v4.1.1

Compare Source

What's Changed

New Contributors

Full Changelog: go-jose/go-jose@v4.1.0...v4.1.1

v4.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: go-jose/go-jose@v4.0.5...v4.1.0

v4.0.5

Compare Source

What's Changed

Fixes GHSA-c6gw-w398-hv78

Various other dependency updates, small fixes, and documentation updates in the full changelog

New Contributors

Full Changelog: go-jose/go-jose@v4.0.4...v4.0.5

v4.0.4: Version 4.0.4

Compare Source

Fixed

  • Reverted "Allow unmarshalling JSONWebKeySets with unsupported key types" as a breaking change. See #​136 / #​137.

v4.0.3: Version 4.0.3

Compare Source

Changed

  • Allow unmarshalling JSONWebKeySets with unsupported key types (#​130)
  • Document that OpaqueKeyEncrypter can't be implemented (for now) (#​129)
  • Dependency updates

v4.0.2: Version 4.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: go-jose/go-jose@v4.0.1...v4.0.2

v4.0.1: Version 4.0.1

Compare Source

Fixed

  • An attacker could send a JWE containing compressed data that used large
    amounts of memory and CPU when decompressed by Decrypt or DecryptMulti.
    Those functions now return an error if the decompressed data would exceed
    250kB or 10x the compressed size (whichever is larger). Thanks to
    Enze Wang@​Alioth and Jianjun Chen@​Zhongguancun Lab (@​zer0yu and @​chenjj)
    for reporting.

v4.0.0: Version 4.0.0

Compare Source

This release makes some breaking changes in order to more thoroughly address the vulnerabilities discussed in Three New Attacks Against JSON Web Tokens, "Sign/encrypt confusion", "Billion hash attack", and "Polyglot token".

Changed

  • Limit JWT encryption types (exclude password or public key types) (#​78)
  • Enforce minimum length for HMAC keys (#​85)
  • jwt: match any audience in a list, rather than requiring all audiences (#​81)
  • jwt: accept only Compact Serialization (#​75)
  • jws: Add expected algorithms for signatures (#​74)
  • Require specifying expected algorithms for ParseEncrypted,
    ParseSigned, ParseDetached, jwt.ParseEncrypted, jwt.ParseSigned,
    jwt.ParseSignedAndEncrypted (#​69, #​74)
    • Usually there is a small, known set of appropriate algorithms for a program to use and it's a mistake to allow unexpected algorithms. For instance the "billion hash attack" relies in part on programs accepting the PBES2 encryption algorithm and doing the necessary work even if they weren't specifically configured to allow PBES2.
  • Revert "Strip padding off base64 strings" (#​82)
  • The specs require base64url encoding without padding.
  • Minimum supported Go version is now 1.21

Added

  • ParseSignedCompact, ParseSignedJSON, ParseEncryptedCompact, ParseEncryptedJSON.
    • These allow parsing a specific serialization, as opposed to ParseSigned and ParseEncrypted, which try to automatically detect which serialization was provided. It's common to require a specific serialization for a specific protocol - for instance JWT requires Compact serialization.
go-viper/mapstructure (github.com/go-viper/mapstructure/v2)

v2.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: go-viper/mapstructure@v2.4.0...v2.5.0

golang-jwt/jwt (github.com/golang-jwt/jwt/v5)

v5.3.1

Compare Source

What's Changed

🔐 Features
👒 Dependencies

New Contributors

Full Changelog: golang-jwt/jwt@v5.3.0...v5.3.1

googleapis/api-linter (github.com/googleapis/api-linter/v2)

v2.3.1

Compare Source

Bug Fixes
  • AIP-191: amend logic java_outer_classname for edition >= 2024 (#​1613) (dc57c9d)
  • AIP-191: skip java_multiple_files for edition >= 2024 (#​1608) (75338d8)

v2.3.0

Compare Source

Features
  • cli: add support for linting descriptor sets only via --skip-compilation (#​1600) (d33d4a7)

v2.2.0

Compare Source

Features
Bug Fixes

v2.1.0

Compare Source

Features
Bug Fixes
  • AIP-134: check word boundaries in synonyms rule (#​1564) (f10744f)
  • AIP-123: prevent panic in getParentIDVariable with single-variable patterns (#​1565) (a09770e)
  • AIP-133: avoid returning an error when return type is a message (#​1578) (3222ce4)
  • AIP-136: Allow SetIamPolicy method (#​1559) (7afac03)
  • AIP-216: avoid linting state-like fields in response message (#​1582) (1760e49)
  • lint: allow deprecation rule on deprecated descriptor (#​1570) (f89a1b8)
  • make Batch naming resource plural aware (#​1573) (c820a1c)
Documentation
  • AIP-133: remove declarative-friendly requirement from spec (#​1581) (6a388a4)
  • AIP-158: clarify response plural first docs (#​1571) (98a8702)
  • fix missing "-" on disable rule command and config command (#​1557) (28f0707)
grpc-ecosystem/go-grpc-middleware (github.com/grpc-ecosystem/go-grpc-middleware)

v2.3.3

Compare Source

What's Changed


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.


Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux
Copy link
Copy Markdown
Author

red-hat-konflux Bot commented May 11, 2026

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.9 -> 1.26.0
github.com/aws/aws-sdk-go-v2/config v1.32.16 -> v1.32.17
File name: hack/tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
github.com/bmatcuk/doublestar/v4 v4.9.1 -> v4.10.0

@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch 4 times, most recently from a8c8072 to d19cd69 Compare May 12, 2026 07:41
@petrpinkas
Copy link
Copy Markdown
Member

/retest

@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch 12 times, most recently from 70d590a to be34f6f Compare May 17, 2026 10:43
@red-hat-konflux
Copy link
Copy Markdown
Author

red-hat-konflux Bot commented May 17, 2026

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go mod tidy
go: downloading github.com/tink-crypto/tink-go-awskms/v3 v3.0.0
go: downloading go.uber.org/goleak v1.3.0
go: downloading github.com/go-rod/rod v0.116.2
go: downloading gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
go: downloading github.com/klauspost/compress v1.18.5
go: downloading github.com/frankban/quicktest v1.14.6
go: downloading go.opentelemetry.io/otel/sdk/metric v1.43.0
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2
go: downloading github.com/go-test/deep v1.1.1
go: downloading github.com/hashicorp/go-hclog v1.6.3
go: downloading github.com/ysmood/goob v0.4.0
go: downloading github.com/ysmood/got v0.40.0
go: downloading github.com/ysmood/gson v0.7.3
go: downloading github.com/ysmood/fetchup v0.2.3
go: downloading github.com/ysmood/leakless v0.9.0
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1
go: downloading github.com/fatih/color v1.18.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading github.com/jmhodges/clock v1.2.0
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/rogpeppe/go-internal v1.14.1
go: downloading gonum.org/v1/gonum v0.17.0
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.37.0
go: downloading github.com/keybase/go-keychain v0.0.1
go: downloading github.com/envoyproxy/go-control-plane v0.14.0
go: downloading github.com/envoyproxy/protoc-gen-validate v1.3.3
go: downloading github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
go: finding module for package github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap
go: finding module for package github.com/grpc-ecosystem/go-grpc-middleware/v2/recovery
go: finding module for package github.com/grpc-ecosystem/go-grpc-middleware/v2/retry
go: finding module for package github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap/ctxzap
go: github.com/sigstore/fulcio/cmd/app imports
	github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap: module github.com/grpc-ecosystem/go-grpc-middleware/v2@latest found (v2.3.3), but does not contain package github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap
go: github.com/sigstore/fulcio/cmd/app imports
	github.com/grpc-ecosystem/go-grpc-middleware/v2/recovery: module github.com/grpc-ecosystem/go-grpc-middleware/v2@latest found (v2.3.3), but does not contain package github.com/grpc-ecosystem/go-grpc-middleware/v2/recovery
go: github.com/sigstore/fulcio/cmd/app imports
	github.com/grpc-ecosystem/go-grpc-middleware/v2/retry: module github.com/grpc-ecosystem/go-grpc-middleware/v2@latest found (v2.3.3), but does not contain package github.com/grpc-ecosystem/go-grpc-middleware/v2/retry
go: github.com/sigstore/fulcio/pkg/log imports
	github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap/ctxzap: module github.com/grpc-ecosystem/go-grpc-middleware/v2@latest found (v2.3.3), but does not contain package github.com/grpc-ecosystem/go-grpc-middleware/v2/logging/zap/ctxzap

@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch 4 times, most recently from a73629b to ca9e69e Compare May 18, 2026 06:39
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch from ca9e69e to 4171ada Compare May 18, 2026 11:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant