build(deps): bump the go-deps group across 1 directory with 10 updates #1744

dependabot · 2025-03-06T02:34:42Z

Bumps the go-deps group with 8 updates in the / directory:

Package	From	To
github.com/elazarl/goproxy	`1.7.0`	`1.7.2`
github.com/fluxcd/pkg/auth	`0.3.0`	`0.6.0`
github.com/fluxcd/pkg/runtime	`0.53.1`	`0.54.0`
github.com/go-git/go-git/v5	`5.13.2`	`5.14.0`
github.com/notaryproject/notation-go	`1.3.0`	`1.3.1`
github.com/prometheus/client_golang	`1.21.0`	`1.21.1`
github.com/sigstore/sigstore	`1.8.15`	`1.9.0`
golang.org/x/sync	`0.11.0`	`0.12.0`

Updates github.com/elazarl/goproxy from 1.7.0 to 1.7.2

Release notes

Sourced from github.com/elazarl/goproxy's releases.

v1.7.2

What's Changed

Avoid breaking changes and port them to the v2 branch instead

Full Changelog: elazarl/goproxy@v1.7.1...v1.7.2

v1.7.1

What's Changed

Add MITM request cancel test by @ErikPelli in elazarl/goproxy#644

Bump golang.org/x/text from 0.21.0 to 0.22.0 in /ext by @dependabot in elazarl/goproxy#645

Bump golang.org/x/net from 0.34.0 to 0.35.0 in /ext by @dependabot in elazarl/goproxy#647

Bump golang.org/x/net from 0.34.0 to 0.35.0 by @dependabot in elazarl/goproxy#646

Add next protocols in default TLS configuration by @ErikPelli in elazarl/goproxy#651

Full Changelog: elazarl/goproxy@v1.7.0...v1.7.1

Commits

09a5680 Revert "Add next protocols in default TLS configuration (#651)"
948b6ca Revert "Connect related changes - add optional hooks (#504)"
44bab45 Connect related changes - add optional hooks (#504)
0003d27 Add next protocols in default TLS configuration (#651)
591e8ff Merge pull request #646 from elazarl/dependabot/go_modules/golang.org/x/net-0...
be1818f Merge pull request #647 from elazarl/dependabot/go_modules/ext/golang.org/x/n...
41dd5c9 Bump golang.org/x/net from 0.34.0 to 0.35.0 in /ext
b0ba765 Bump golang.org/x/net from 0.34.0 to 0.35.0
1f65b1b Merge pull request #645 from elazarl/dependabot/go_modules/ext/golang.org/x/t...
3d75816 Bump golang.org/x/text from 0.21.0 to 0.22.0 in /ext
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/auth from 0.3.0 to 0.6.0

Commits

288cd7a Merge pull request #752 from fluxcd/handle-in-cluster-annotation
4971c85 Return a DiffTypeExclude when exclusion annotation is set in cluster
46467e7 Merge pull request #754 from fluxcd/update-docker
43f36aa Update docker dependencies
e350b5b Merge pull request #750 from fluxcd/update-deps-go-1.22
3ad72d9 Update dependencies to Go 1.22 and Kubernetes 1.29.3
6ad47ef Merge pull request #751 from fluxcd/disable-bitbucket-server-tests
9ba119b Disable bitbucket-server e2e
e8f9e40 Merge pull request #723 from gdasson/main
5c27146 Adding common "reason" constants
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.53.1 to 0.54.0

Commits

e0f6da0 Merge pull request #873 from fluxcd/lazy-restmapper
60bfc04 Update controller-runtime to v0.20.2
7c5e477 Vendor the lazy restmapper from controller-runtime v0.19
00d1ceb Merge pull request #844 from 94DanielBrown/main
13f8832 chore: add function to group entries by action in changeset output
See full diff in compare view

Updates github.com/go-git/go-git/v5 from 5.13.2 to 5.14.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.14.0

What's Changed

v5: Bump Go and dependencies to mitigate GO-2025-3487 by @pjbgf in go-git/go-git#1436

⚠️ Note that this version requires Go 1.23, due to the bump to golang.org/x/[email protected] which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.

Full Changelog: go-git/go-git@v5.13.2...v5.14.0

Commits

863c621 Merge pull request #1436 from pjbgf/v5-bumps
2e69e81 build: Bump dependencies
b2c1ec9 build: Bump Go versions
See full diff in compare view

Updates github.com/notaryproject/notation-go from 1.3.0 to 1.3.1

Release notes

Sourced from github.com/notaryproject/notation-go's releases.

v1.3.1

Vote PASSED [+5 -0]: #517

Bug fix

This patch release removes the timestamp check against signing time during authentic timestamp verification due to potential time skew and the unauthenticated nature of signing time field.

What's Changed

bump: release v1.3.0 by @Two-Hearts in notaryproject/notation-go#507

fix: remove signing time check during authenticTimestamp by @Two-Hearts in notaryproject/notation-go#514

bump: bump up dependencies for release-1.3 branch by @Two-Hearts in notaryproject/notation-go#516

Full Changelog: notaryproject/notation-go@v1.3.0...v1.3.1

Commits

961cef1 bump: release v1.3.1
f171fb0 bump: bump up dependencies for release-1.3 branch (#516)
540cc34 fix: remove signing time check during authenticTimestamp (#514)
1864576 Merge pull request #507 from Two-Hearts/release-1.3
See full diff in compare view

Updates github.com/prometheus/client_golang from 1.21.0 to 1.21.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.21.1 / 2025-03-04

This release addresses a performance regression introduced in #1661 -- thanks to all who reported this quickly: @chlunde, @dethi, @aaronbee @tsuna @kakkoyun 💪🏽. This patch release also fixes the iOS build.

We will be hardening the release process even further (#1759, #1761) to prevent this in future, sorry for the inconvenience!

The high concurrency optimization is planned to be eventually reintroduced, however in a much safer manner, potentially in a separate API.

[BUGFIX] prometheus: Revert of Inc, Add and Observe cumulative metric CAS optimizations (#1661), causing regressions on low concurrency cases #1757

[BUGFIX] prometheus: Fix GOOS=ios build, broken due to process_collector_* wrong build tags. #1758

Revert "exponential backoff for CAS operations on floats" and cut 1.21.1 by @bwplotka in prometheus/client_golang#1757

Fix ios build for 1.21.1 by @bwplotka in prometheus/client_golang#1758

Full Changelog: prometheus/client_golang@v1.21.0...v1.21.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.21.1 / 2025-03-04

[BUGFIX] prometheus: Revert of Inc, Add and Observe cumulative metric CAS optimizations (#1661), causing regressions on low contention cases.

[BUGFIX] prometheus: Fix GOOS=ios build, broken due to process_collector_* wrong build tags.

Commits

8a42da3 Fix ios build. (#1758)
40c62f7 Merge pull request #1757 from prometheus/revert-121cas
689f590 Cut 1.21.1
9e567a7 Revert "Add: exponential backoff for CAS operations on floats (#1661)"
See full diff in compare view

Updates github.com/sigstore/sigstore from 1.8.15 to 1.9.0

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.9.0

What's Changed

Update KMS policy for new plugin interface by @haydentherapper in sigstore/sigstore#1987

Update TUF root to latest v12 root by @haydentherapper in sigstore/sigstore#1988

build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 by @dependabot in sigstore/sigstore#1994

upgrade go-jose to v4 by @cpanato in sigstore/sigstore#2000

pkg/signature: expose Algorithm Details information by @ret2libc in sigstore/sigstore#2001

Full Changelog: sigstore/sigstore@v1.8.15...v1.9.0

Commits

a304698 pkg/signature: expose Algorithm Details information (#2001)
bf09332 build(deps): Bump actions/cache from 4.2.1 to 4.2.2 in the all group (#2013)
47d4326 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2011)
ffbe3d5 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2009)
9c71796 build(deps): Bump golang.org/x/oauth2 from 0.26.0 to 0.27.0 (#2008)
468a565 build(deps): Bump github.com/google/go-cmp from 0.6.0 to 0.7.0 (#2007)
341e085 build(deps): Bump google.golang.org/api in /pkg/signature/kms/gcp (#2006)
5249c79 build(deps): Bump golang.org/x/crypto from 0.32.0 to 0.35.0 (#2003)
79d4d1e build(deps): Bump github.com/sigstore/sigstore (#1992)
a1f51d7 build(deps): Bump the gomod group across 5 directories with 7 updates (#2005)
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.33.0 to 0.35.0

Commits

7292932 ssh: limit the size of the internal packet queue while waiting for KEX
f66f74b acme/autocert: check host policy before probing the cache
b0784b7 x509roots/fallback: drop obsolete build constraint
911360c all: bump golang.org/x/crypto dependencies of asm generators
89ff08d all: upgrade go directive to at least 1.23.0 [generated]
e47973b all: update certs for go1.24
See full diff in compare view

Updates golang.org/x/oauth2 from 0.26.0 to 0.27.0

Commits

681b4d8 jws: split token into fixed number of parts
3f78298 all: upgrade go directive to at least 1.23.0 [generated]
109dabf endpoints: add links/provider for Discord
ac571fa oauth2: fix docs for Config.DeviceAuth
314ee5b endpoints: add patreon endpoint
See full diff in compare view

Updates golang.org/x/sync from 0.11.0 to 0.12.0

Commits

b637f27 errgroup: drop support for Go versions before 1.20
960bf1f all: upgrade go directive to at least 1.23.0 [generated]
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-deps group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy) | `1.7.0` | `1.7.2` | | [github.com/fluxcd/pkg/auth](https://github.com/fluxcd/pkg) | `0.3.0` | `0.6.0` | | [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.53.1` | `0.54.0` | | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.13.2` | `5.14.0` | | [github.com/notaryproject/notation-go](https://github.com/notaryproject/notation-go) | `1.3.0` | `1.3.1` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.21.0` | `1.21.1` | | [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.8.15` | `1.9.0` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.11.0` | `0.12.0` | Updates `github.com/elazarl/goproxy` from 1.7.0 to 1.7.2 - [Release notes](https://github.com/elazarl/goproxy/releases) - [Commits](elazarl/goproxy@v1.7.0...v1.7.2) Updates `github.com/fluxcd/pkg/auth` from 0.3.0 to 0.6.0 - [Commits](fluxcd/pkg@tar/v0.3.0...tar/v0.6.0) Updates `github.com/fluxcd/pkg/runtime` from 0.53.1 to 0.54.0 - [Commits](fluxcd/pkg@runtime/v0.53.1...runtime/v0.54.0) Updates `github.com/go-git/go-git/v5` from 5.13.2 to 5.14.0 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.13.2...v5.14.0) Updates `github.com/notaryproject/notation-go` from 1.3.0 to 1.3.1 - [Release notes](https://github.com/notaryproject/notation-go/releases) - [Changelog](https://github.com/notaryproject/notation-go/blob/main/RELEASE_CHECKLIST.md) - [Commits](notaryproject/notation-go@v1.3.0...v1.3.1) Updates `github.com/prometheus/client_golang` from 1.21.0 to 1.21.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.21.0...v1.21.1) Updates `github.com/sigstore/sigstore` from 1.8.15 to 1.9.0 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.8.15...v1.9.0) Updates `golang.org/x/crypto` from 0.33.0 to 0.35.0 - [Commits](golang/crypto@v0.33.0...v0.35.0) Updates `golang.org/x/oauth2` from 0.26.0 to 0.27.0 - [Commits](golang/oauth2@v0.26.0...v0.27.0) Updates `golang.org/x/sync` from 0.11.0 to 0.12.0 - [Commits](golang/sync@v0.11.0...v0.12.0) --- updated-dependencies: - dependency-name: github.com/elazarl/goproxy dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/auth dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/runtime dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/go-git/go-git/v5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/notaryproject/notation-go dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/prometheus/client_golang dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/sigstore/sigstore dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/sync dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2025-03-10T02:12:48Z

Superseded by #1746.

dependabot bot added the dependencies Pull requests that update a dependency label Mar 6, 2025

dependabot bot closed this Mar 10, 2025

dependabot bot deleted the dependabot/go_modules/go-deps-5fb6400fb4 branch March 10, 2025 02:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the go-deps group across 1 directory with 10 updates #1744

build(deps): bump the go-deps group across 1 directory with 10 updates #1744

Uh oh!

dependabot bot commented on behalf of github Mar 6, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Mar 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

build(deps): bump the go-deps group across 1 directory with 10 updates #1744

build(deps): bump the go-deps group across 1 directory with 10 updates #1744

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.7.2

What's Changed

v1.7.1

What's Changed

v5.14.0

What's Changed

v1.3.1

Bug fix

What's Changed

v1.21.1 / 2025-03-04

1.21.1 / 2025-03-04

v1.9.0

What's Changed

Uh oh!

dependabot bot commented on behalf of github Mar 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Mar 6, 2025 •

edited

Loading