Skip to content

chore(deps): bump the gomod group across 1 directory with 14 updates #717

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): bump the gomod group across 1 directory with 14 updates #717

dependabot wants to merge 1 commit into from
+53 −50

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 26, 2026

Bumps the gomod group with 6 updates in the / directory:

Package From To
github.com/in-toto/in-toto-golang 0.9.0 0.10.0
github.com/prometheus/client_golang 1.22.0 1.23.2
go.uber.org/zap 1.27.0 1.27.1
github.com/prometheus/procfs 0.17.0 0.19.2
go.yaml.in/yaml/v2 2.4.2 2.4.3
sigs.k8s.io/yaml 1.5.0 1.6.0

Updates github.com/in-toto/in-toto-golang from 0.9.0 to 0.10.0

Release notes

Sourced from github.com/in-toto/in-toto-golang's releases.

v0.10.0

What's Changed

... (truncated)

Commits
  • db554e2 Merge pull request #450 from in-toto/dependabot/go_modules/all-e2678a00b5
  • b2ea0f2 chore(deps): bump golang.org/x/sys in the all group
  • acc2f33 Merge pull request #448 from in-toto/dependabot/go_modules/github.com/secure-...
  • 313b1d6 Merge pull request #449 from in-toto/dependabot/github_actions/all-2ed24f8e11
  • d9a60af chore(deps): bump github.com/secure-systems-lab/go-securesystemslib
  • e7783d5 chore(deps): bump the all group with 3 updates
  • 7a1798a Merge pull request #447 from in-toto/fix-ci
  • b6af1a7 Modernize CI and automation
  • ad67645 Merge pull request #446 from in-toto/dependabot/go_modules/google.golang.org/...
  • b63fd33 chore(deps): bump google.golang.org/grpc from 1.74.2 to 1.78.0
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.22.0 to 1.23.2

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.23.2 - 2025-09-05

This release is made to upgrade to prometheus/common v0.66.1, which drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement). There are no functional changes.

Full Changelog: prometheus/client_golang@v1.23.1...v1.23.2

v1.23.1 - 2025-09-04

This release is made to be compatible with a backwards incompatible API change in prometheus/common v0.66.0. There are no functional changes.

Full Changelog: prometheus/client_golang@v1.23.0...v1.23.1

v1.23.0 - 2025-07-30

  • [CHANGE] Minimum required Go version is now 1.23, only the two latest Go versions are supported from now on. #1812
  • [FEATURE] Add WrapCollectorWith and WrapCollectorWithPrefix #1766
  • [FEATURE] Add exemplars for native histograms #1686
  • [ENHANCEMENT] exp/api: Bubble up status code from writeResponse #1823
  • [ENHANCEMENT] collector/go: Update runtime metrics for Go v1.23 and v1.24 #1833
  • [BUGFIX] exp/api: client prompt return on context cancellation #1729

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.23.2 / 2025-09-05

This release is made to upgrade to prometheus/common v0.66.1, which drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement). There are no functional changes.

1.23.1 / 2025-09-04

This release is made to be compatible with a backwards incompatible API change in prometheus/common v0.66.0. There are no functional changes.

1.23.0 / 2025-07-30

  • [CHANGE] Minimum required Go version is now 1.23, only the two latest Go versions are supported from now on. #1812
  • [FEATURE] Add WrapCollectorWith and WrapCollectorWithPrefix #1766
  • [FEATURE] Add exemplars for native histograms #1686
  • [ENHANCEMENT] exp/api: Bubble up status code from writeResponse #1823
  • [ENHANCEMENT] collector/go: Update runtime metrics for Go v1.23 and v1.24 #1833
  • [BUGFIX] exp/api: client prompt return on context cancellation #1729
Commits

Updates github.com/spf13/cobra from 1.9.1 to 1.10.2

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.10.2

🔧 Dependencies

  • chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @​dims in spf13/cobra#2336 - the gopkg.in/yaml.v3 package has been deprecated for some time: this should significantly cleanup dependency/supply-chains for consumers of spf13/cobra

📈 CI/CD

🔥✍🏼 Docs

🍂 Refactors

🤗 New Contributors

Full Changelog: spf13/cobra@v1.10.1...v1.10.2

Thank you to our amazing contributors!!!!! 🐍 🚀

v1.10.1

🐛 Fix

v1.0.9 of pflags brought back ParseErrorsWhitelist and marked it as deprecated

Full Changelog: spf13/cobra@v1.10.0...v1.10.1

v1.10.0

What's Changed

🚨 Attention!

This version of pflag carried a breaking change: it renamed ParseErrorsWhitelist to ParseErrorsAllowlist which can break builds if both pflag and cobra are dependencies in your project.

  • If you use both pflag and cobra, upgrade pflagto 1.0.8 andcobrato1.10.0`
  • or use the newer, fixed version of pflag v1.0.9 which keeps the deprecated ParseErrorsWhitelist

... (truncated)

Commits

Updates go.uber.org/zap from 1.27.0 to 1.27.1

Release notes

Sourced from go.uber.org/zap's releases.

v1.27.1

Enhancements:

  • #1501[]: prevent Object from panicking on nils
  • #1511[]: Fix a race condition in WithLazy.

Thanks to @​rabbbit, @​alshopov, @​jquirke, @​arukiidou for their contributions to this release.

#1501: uber-go/zap#1501 #1511: uber-go/zap#1511

Changelog

Sourced from go.uber.org/zap's changelog.

1.27.1 (19 Nov 2025)

Enhancements:

  • #1501[]: prevent Object from panicking on nils
  • #1511[]: Fix a race condition in WithLazy.

Thanks to @​rabbbit, @​alshopov, @​jquirke, @​arukiidou for their contributions to this release.

#1501: uber-go/zap#1501 #1511: uber-go/zap#1511

Commits

Updates github.com/prometheus/common from 0.65.0 to 0.66.1

Release notes

Sourced from github.com/prometheus/common's releases.

v0.66.1

This release has no functional changes, it just drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement).

What's Changed

Full Changelog: prometheus/common@v1.20.99...v0.66.1

v0.66.0

⚠️ Breaking Changes ⚠️

  • A default-constructed TextParser will be invalid. It must have a valid scheme set, so users should use the NewTextParser function to create a valid TextParser. Otherwise parsing will panic with "Invalid name validation scheme requested: unset".

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from github.com/prometheus/common's changelog.

v0.66.1 / 2025-09-05

This release has no functional changes, it just drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement).

What's Changed

Full Changelog: prometheus/common@v1.20.99...v0.66.1

v0.66.0 / 2025-09-02

⚠️ Breaking Changes ⚠️

  • A default-constructed TextParser will be invalid. It must have a valid scheme set, so users should use the NewTextParser function to create a valid TextParser. Otherwise parsing will panic with "Invalid name validation scheme requested: unset".

What's Changed

New Contributors

... (truncated)

Commits
  • 8975dde Revert "Use go.uber.org/atomic instead of sync/atomic (#825)" (#838)
  • 08d7f66 Move to supported version of yaml parser (#834)
  • 80e275e Revert "Use github.com/grafana/regexp instead of regexp" (#835)
  • 4c2f9e7 Merge pull request #832 from roidelapluie/retract
  • e120453 Retract v1.20.3
  • 2b1487c Merge pull request #827 from prometheus/dependabot/go_modules/github.com/stre...
  • db38951 Merge pull request #829 from prometheus/dependabot/go_modules/golang.org/x/ne...
  • 9e19a90 build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1
  • a1ba2a7 build(deps): bump golang.org/x/net from 0.42.0 to 0.43.0
  • c7a031c Merge pull request #830 from prometheus/dependabot/go_modules/google.golang.o...
  • Additional commits viewable in compare view

Updates github.com/prometheus/procfs from 0.17.0 to 0.19.2

Release notes

Sourced from github.com/prometheus/procfs's releases.

v0.19.2

What's Changed

Full Changelog: prometheus/procfs@v0.19.1...v0.19.2

v0.19.1

What's Changed

Full Changelog: prometheus/procfs@v0.19.0...v0.19.1

v0.19.0

What's Changed

New Contributors

Full Changelog: prometheus/procfs@v0.18.0...v0.19.0

v0.18.0

What's Changed

New Contributors

... (truncated)

Commits

Updates github.com/secure-systems-lab/go-securesystemslib from 0.9.0 to 0.10.0

Commits
  • 93d7e1c Merge pull request #139 from secure-systems-lab/dependabot/github_actions/gol...
  • b2fe7df Merge pull request #138 from secure-systems-lab/dependabot/github_actions/act...
  • 7e9f79e chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.2.0
  • 1552d12 chore(deps): bump actions/setup-go from 5.5.0 to 6.1.0
  • d1d5111 Merge...

    Description has been truncated

@dependabot
chore(deps): bump the gomod group across 1 directory with 14 updates
bf889e8 
Bumps the gomod group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/in-toto/in-toto-golang](https://github.com/in-toto/in-toto-golang) | `0.9.0` | `0.10.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.22.0` | `1.23.2` |
| [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.0` | `1.27.1` |
| [github.com/prometheus/procfs](https://github.com/prometheus/procfs) | `0.17.0` | `0.19.2` |
| [go.yaml.in/yaml/v2](https://github.com/yaml/go-yaml) | `2.4.2` | `2.4.3` |
| [sigs.k8s.io/yaml](https://github.com/kubernetes-sigs/yaml) | `1.5.0` | `1.6.0` |



Updates `github.com/in-toto/in-toto-golang` from 0.9.0 to 0.10.0
- [Release notes](https://github.com/in-toto/in-toto-golang/releases)
- [Changelog](https://github.com/in-toto/in-toto-golang/blob/master/CHANGELOG.md)
- [Commits](in-toto/in-toto-golang@v0.9.0...v0.10.0)

Updates `github.com/prometheus/client_golang` from 1.22.0 to 1.23.2
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.22.0...v1.23.2)

Updates `github.com/spf13/cobra` from 1.9.1 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.9.1...v1.10.2)

Updates `go.uber.org/zap` from 1.27.0 to 1.27.1
- [Release notes](https://github.com/uber-go/zap/releases)
- [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md)
- [Commits](uber-go/zap@v1.27.0...v1.27.1)

Updates `github.com/prometheus/common` from 0.65.0 to 0.66.1
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md)
- [Commits](prometheus/common@v0.65.0...v0.66.1)

Updates `github.com/prometheus/procfs` from 0.17.0 to 0.19.2
- [Release notes](https://github.com/prometheus/procfs/releases)
- [Commits](prometheus/procfs@v0.17.0...v0.19.2)

Updates `github.com/secure-systems-lab/go-securesystemslib` from 0.9.0 to 0.10.0
- [Release notes](https://github.com/secure-systems-lab/go-securesystemslib/releases)
- [Commits](secure-systems-lab/go-securesystemslib@v0.9.0...v0.10.0)

Updates `github.com/spf13/pflag` from 1.0.7 to 1.0.10
- [Release notes](https://github.com/spf13/pflag/releases)
- [Commits](spf13/pflag@v1.0.7...v1.0.10)

Updates `go.yaml.in/yaml/v2` from 2.4.2 to 2.4.3
- [Commits](yaml/go-yaml@v2.4.2...v2.4.3)

Updates `golang.org/x/crypto` from 0.40.0 to 0.46.0
- [Commits](golang/crypto@v0.40.0...v0.46.0)

Updates `golang.org/x/sys` from 0.34.0 to 0.40.0
- [Commits](golang/sys@v0.34.0...v0.40.0)

Updates `golang.org/x/text` from 0.27.0 to 0.32.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.27.0...v0.32.0)

Updates `google.golang.org/protobuf` from 1.36.6 to 1.36.11

Updates `sigs.k8s.io/yaml` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/kubernetes-sigs/yaml/releases)
- [Changelog](https://github.com/kubernetes-sigs/yaml/blob/master/RELEASE.md)
- [Commits](kubernetes-sigs/yaml@v1.5.0...v1.6.0)

---
updated-dependencies:
- dependency-name: github.com/in-toto/in-toto-golang
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: go.uber.org/zap
  dependency-version: 1.27.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/prometheus/common
  dependency-version: 0.66.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/prometheus/procfs
  dependency-version: 0.19.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/secure-systems-lab/go-securesystemslib
  dependency-version: 0.10.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/spf13/pflag
  dependency-version: 1.0.10
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: go.yaml.in/yaml/v2
  dependency-version: 2.4.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: golang.org/x/crypto
  dependency-version: 0.46.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: golang.org/x/sys
  dependency-version: 0.40.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: golang.org/x/text
  dependency-version: 0.32.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.11
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: sigs.k8s.io/yaml
  dependency-version: 1.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jan 26, 2026
@kusari-inspector
Copy link

kusari-inspector bot commented Jan 26, 2026

⚠️ Workspace Mapping Required

Hello! We noticed that your GitHub organization is not yet mapped to a Kusari workspace. Kusari Inspector now requires installations to be associated with a Kusari workspace.

⚠️ NOTE: Only the admin who installed the Kusari GitHub App can complete these steps. If the admin is unable to complete these steps, please contact [email protected]

To complete the setup:

  1. Visit https://console.us.kusari.cloud/auth/github and log in via github
  2. If you have only one workspace, it will be automatically selected for you
  3. Once the mapping is complete, return here and create a new comment with: @kusari-inspector re-run

This will trigger the analysis to run again.

For more information, or if you need help, visit https://github.com/kusaridev/community/discussions

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants