fix(deps): update all dependencies by renovate[bot] · Pull Request #35 · aperturerobotics/go-kvfile

renovate · 2025-11-04T10:48:39Z

This PR contains the following updates:

Package	Type	Update	Change
actions/dependency-review-action	action	minor	`v4.8.2` → `v4.9.0`
actions/setup-go	action	minor	`v6.2.0` → `v6.3.0`
github.com/aperturerobotics/cli	require	minor	`v1.0.1` → `v1.1.0`
github.com/aperturerobotics/common	require	minor	`v0.24.0` → `v0.32.0`
github.com/aperturerobotics/protobuf-go-lite	require	minor	`v0.11.0` → `v0.12.2`
github.com/klauspost/compress	require	patch	`v1.18.3` → `v1.18.4`
github/codeql-action	action	minor	`v4.31.11` → `v4.32.6`

Release Notes

actions/dependency-review-action (actions/dependency-review-action)

`v4.9.0`: Dependency Review Action 4.9.0

Compare Source

This feature release contains a couple of notable changes:

There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @felickz!
Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @jantiebot!
There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @juxtin!

What's Changed

Compare normalized purls to account for encoding quirks by @juxtin in #1056
Make purl comparisons case insensitive by @juxtin in #1057
Feat: Add Patched Version to Vulnerabilities summary by @felickz in #1045
fix: only get scorecard levels if user wants to see the OpenSSF scorecard by @jantiebot in #1060
Bump actions/stale from 10.1.0 to 10.2.0 by @dependabot[bot] in #1058
Bump actions/checkout from 4 to 6 by @dependabot[bot] in #1021
Updates for release 4.9.0 by @ahpook in #1064

New Contributors

@jantiebot made their first contribution in #1060

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

`v4.8.3`: 4.8.3

Compare Source

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

GitHub Actions can't push to our protected main by @dangoor in #1017
Bump actions/stale from 9.1.0 to 10.1.0 by @dependabot[bot] in #995
Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #1003
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #1005
Upgrade glob to address a vulnerability by @brrygrdn in #1024
Bump js-yaml by @dependabot[bot] in #1020
Addressing vulnerabilities by @Ahmed3lmallah in #1036
Bump fast-xml-parser from 5.3.3 to 5.3.5 by @dependabot[bot] in #1050
Bump fast-xml-parser from 5.3.5 to 5.3.6 by @dependabot[bot] in #1053
Properly truncate long summaries and catch errors by @juxtin in #1052
Bump spdx-expression-parse from 3.0.1 to 4.0.0 in the spdx-licenses group across 1 directory by @dependabot[bot] in #931
Changes for Release 4.8.3 by @ahpook in #1054

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3

actions/setup-go (actions/setup-go)

`v6.3.0`

Compare Source

What's Changed

Update default Go module caching to use go.mod by @priyagupta108 in #705
Fix golang download url to go.dev by @178inaba in #469

Full Changelog: actions/setup-go@v6...v6.3.0

aperturerobotics/cli (github.com/aperturerobotics/cli)

`v1.1.0`

Compare Source

aperturerobotics/common (github.com/aperturerobotics/common)

What's Changed

fix(deps): update all dependencies by @renovate[bot] in #46

Full Changelog: aperturerobotics/common@v0.30.7...v0.31.0

`v0.30.7`

Compare Source

Full Changelog: aperturerobotics/common@v0.30.6...v0.30.7

`v0.30.6`

Compare Source

Full Changelog: aperturerobotics/common@v0.30.5...v0.30.6

`v0.30.5`

Compare Source

Full Changelog: aperturerobotics/common@v0.30.4...v0.30.5

`v0.30.4`

Compare Source

Full Changelog: aperturerobotics/common@v0.30.3...v0.30.4

`v0.30.3`

Compare Source

Full Changelog: aperturerobotics/common@v0.30.2...v0.30.3

`v0.30.2`

Compare Source

Full Changelog: aperturerobotics/common@v0.30.1...v0.30.2

`v0.30.1`

Compare Source

Full Changelog: aperturerobotics/common@v0.30.0...v0.30.1

`v0.30.0`

Compare Source

Full Changelog: aperturerobotics/common@v0.29.0...v0.30.0

`v0.29.0`

Compare Source

Full Changelog: aperturerobotics/common@v0.28.0...v0.29.0

`v0.28.0`

Compare Source

Full Changelog: aperturerobotics/common@v0.27.1...v0.28.0

`v0.27.1`

Compare Source

Full Changelog: aperturerobotics/common@v0.27.0...v0.27.1

`v0.27.0`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.11...v0.27.0

`v0.26.11`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.10...v0.26.11

`v0.26.10`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.9...v0.26.10

`v0.26.9`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.8...v0.26.9

`v0.26.8`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.7...v0.26.8

`v0.26.7`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.6...v0.26.7

`v0.26.6`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.5...v0.26.6

`v0.26.5`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.4...v0.26.5

`v0.26.4`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.3...v0.26.4

`v0.26.3`

Compare Source

What's Changed

fix(deps): update all dependencies by @renovate[bot] in #44

Full Changelog: aperturerobotics/common@v0.26.2...v0.26.3

`v0.26.2`

Compare Source

Full Changelog: aperturerobotics/common@v0.26.1...v0.26.2

`v0.26.1`

Compare Source

`v0.25.0`

Compare Source

aperturerobotics/protobuf-go-lite (github.com/aperturerobotics/protobuf-go-lite)

`v0.12.2`

Compare Source

`v0.12.1`

Compare Source

`v0.12.0`

Compare Source

klauspost/compress (github.com/klauspost/compress)

`v1.18.4`

Compare Source

What's Changed

gzhttp: Add zstandard to server handler wrapper by @klauspost in #1121
zstd: Add ResetWithOptions to encoder/decoder by @klauspost in #1122
gzhttp: preserve qvalue when extra parameters follow in Accept-Encoding by @analytically in #1116

New Contributors

@analytically made their first contribution in #1116
@ethaizone made their first contribution in #1124
@zwass made their first contribution in #1125

Full Changelog: klauspost/compress@v1.18.2...v1.18.4

github/codeql-action (github/codeql-action)

`v4.32.6`

Compare Source

Update default CodeQL bundle version to 2.24.3. #3548

`v4.32.5`

Compare Source

Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507
Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487
The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. #3515
Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. #3516
Added an experimental change which lowers the minimum disk space requirement for improved incremental analysis, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. #3498
Added an experimental change which allows the start-proxy action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. #3512
The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. #3503, #3504

`v4.32.4`

Compare Source

Update default CodeQL bundle version to 2.24.2. #3493
Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473
When the CodeQL Action is run with debugging enabled in Default Setup and private package registries are configured, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. #3486
Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. #3485
Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a nightly CodeQL CLI release instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. #3484

`v4.32.3`

Compare Source

Added experimental support for testing connections to private package registries. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. #3466

`v4.32.2`

Compare Source

`v4.32.1`

Compare Source

A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #3422
Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #3421

`v4.32.0`

Compare Source

Update default CodeQL bundle version to 2.24.0. #3425

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-01-31T04:36:42Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/aperturerobotics/cli@v1.0.1 ⏵ v1.1.0
	github.com/klauspost/compress@v1.18.3 ⏵ v1.18.4	⁺¹
	github.com/aperturerobotics/common@v0.24.0 ⏵ v0.32.0	^-1
	github.com/aperturerobotics/protobuf-go-lite@v0.11.0 ⏵ v0.12.2

View full report

renovate · 2026-02-03T04:55:30Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated

Details:

Package	Change
`github.com/aperturerobotics/json-iterator-lite`	`v1.0.1-0.20250712004945-4e5f8882b0b8` -> `v1.0.1-0.20251104042408-0c9eb8a3f726`

socket-security · 2026-02-03T13:58:47Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

renovate bot force-pushed the renovate/all branch from 61a40a5 to d141c99 Compare November 11, 2025 00:14

renovate bot changed the title ~~fix(deps): update module github.com/aperturerobotics/cli to v1.0.1~~ fix(deps): update all dependencies Nov 11, 2025

renovate bot force-pushed the renovate/all branch 5 times, most recently from 925c5a2 to c718684 Compare November 18, 2025 22:31

renovate bot changed the title ~~fix(deps): update all dependencies~~ fix(deps): update all dependencies - autoclosed Nov 19, 2025

renovate bot closed this Nov 19, 2025

renovate bot deleted the renovate/all branch November 19, 2025 08:22

renovate bot changed the title ~~fix(deps): update all dependencies - autoclosed~~ chore(deps): update actions/setup-go action to v6.1.0 Nov 20, 2025

renovate bot reopened this Nov 20, 2025

renovate bot force-pushed the renovate/all branch 2 times, most recently from c718684 to d1e5dd6 Compare November 20, 2025 05:21

renovate bot changed the title ~~chore(deps): update actions/setup-go action to v6.1.0~~ chore(deps): update all dependencies Nov 20, 2025

renovate bot force-pushed the renovate/all branch 3 times, most recently from b6ea58a to 515115a Compare November 26, 2025 09:54

renovate bot changed the title ~~chore(deps): update all dependencies~~ fix(deps): update all dependencies Nov 26, 2025

renovate bot force-pushed the renovate/all branch 3 times, most recently from 20172a6 to ea46088 Compare December 2, 2025 18:02

renovate bot force-pushed the renovate/all branch 3 times, most recently from ddbc2ba to bd661ca Compare December 16, 2025 23:08

renovate bot force-pushed the renovate/all branch 2 times, most recently from 14ebaed to 22e74de Compare January 13, 2026 04:59

renovate bot changed the title ~~fix(deps): update all dependencies~~ fix(deps): update all dependencies - autoclosed Jan 14, 2026

renovate bot closed this Jan 14, 2026

renovate bot changed the title ~~fix(deps): update all dependencies - autoclosed~~ fix(deps): update module github.com/klauspost/compress to v1.18.3 Jan 16, 2026

renovate bot force-pushed the renovate/all branch from 0cd2a2d to c6ff371 Compare January 31, 2026 04:36

renovate bot changed the title ~~chore(deps): update github/codeql-action action to v4.32.0~~ fix(deps): update all dependencies Jan 31, 2026

renovate bot force-pushed the renovate/all branch 4 times, most recently from 6f4a064 to 06d0d2f Compare February 3, 2026 04:55

renovate bot force-pushed the renovate/all branch 2 times, most recently from c53dff8 to bbc7847 Compare February 3, 2026 13:58

renovate bot force-pushed the renovate/all branch 4 times, most recently from c74d9fd to 843c36f Compare February 11, 2026 06:11

renovate bot force-pushed the renovate/all branch 5 times, most recently from fdc4975 to 97edc1d Compare February 20, 2026 05:04

renovate bot force-pushed the renovate/all branch 5 times, most recently from 7402ddb to 6ef0d52 Compare February 26, 2026 04:51

renovate bot force-pushed the renovate/all branch 3 times, most recently from 555e4e7 to 47bef67 Compare March 4, 2026 00:47

fix(deps): update all dependencies

8f561db

renovate bot force-pushed the renovate/all branch from 47bef67 to 8f561db Compare March 5, 2026 22:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update all dependencies#35

fix(deps): update all dependencies#35
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/all

renovate bot commented Nov 4, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Jan 31, 2026 •

edited

Loading

Uh oh!

renovate bot commented Feb 3, 2026

Uh oh!

socket-security bot commented Feb 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.9.0: Dependency Review Action 4.9.0

What's Changed

New Contributors

v4.8.3: 4.8.3

Dependency Review Action v4.8.3

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

socket-security bot commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate bot commented Feb 3, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

socket-security bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

renovate bot commented Nov 4, 2025 •

edited

Loading

`v4.9.0`: Dependency Review Action 4.9.0

`v4.8.3`: 4.8.3

socket-security bot commented Jan 31, 2026 •

edited

Loading

socket-security bot commented Feb 3, 2026 •

edited

Loading