build(deps): bump the go-deps group across 1 directory with 11 updates #1748

dependabot · 2025-03-11T02:51:00Z

Bumps the go-deps group with 9 updates in the / directory:

Package	From	To
github.com/elazarl/goproxy	`1.7.0`	`1.7.2`
github.com/fluxcd/pkg/auth	`0.3.0`	`0.7.0`
github.com/fluxcd/pkg/runtime	`0.53.1`	`0.54.0`
github.com/go-git/go-git/v5	`5.13.2`	`5.14.0`
github.com/minio/minio-go/v7	`7.0.87`	`7.0.88`
github.com/notaryproject/notation-go	`1.3.0`	`1.3.1`
github.com/prometheus/client_golang	`1.21.0`	`1.21.1`
github.com/sigstore/sigstore	`1.8.15`	`1.9.1`
golang.org/x/sync	`0.11.0`	`0.12.0`

Updates github.com/elazarl/goproxy from 1.7.0 to 1.7.2

Release notes

Sourced from github.com/elazarl/goproxy's releases.

v1.7.2

What's Changed

Avoid breaking changes and port them to the v2 branch instead

Full Changelog: elazarl/goproxy@v1.7.1...v1.7.2

v1.7.1

What's Changed

Add MITM request cancel test by @ErikPelli in elazarl/goproxy#644

Bump golang.org/x/text from 0.21.0 to 0.22.0 in /ext by @dependabot in elazarl/goproxy#645

Bump golang.org/x/net from 0.34.0 to 0.35.0 in /ext by @dependabot in elazarl/goproxy#647

Bump golang.org/x/net from 0.34.0 to 0.35.0 by @dependabot in elazarl/goproxy#646

Add next protocols in default TLS configuration by @ErikPelli in elazarl/goproxy#651

Full Changelog: elazarl/goproxy@v1.7.0...v1.7.1

Commits

09a5680 Revert "Add next protocols in default TLS configuration (#651)"
948b6ca Revert "Connect related changes - add optional hooks (#504)"
44bab45 Connect related changes - add optional hooks (#504)
0003d27 Add next protocols in default TLS configuration (#651)
591e8ff Merge pull request #646 from elazarl/dependabot/go_modules/golang.org/x/net-0...
be1818f Merge pull request #647 from elazarl/dependabot/go_modules/ext/golang.org/x/n...
41dd5c9 Bump golang.org/x/net from 0.34.0 to 0.35.0 in /ext
b0ba765 Bump golang.org/x/net from 0.34.0 to 0.35.0
1f65b1b Merge pull request #645 from elazarl/dependabot/go_modules/ext/golang.org/x/t...
3d75816 Bump golang.org/x/text from 0.21.0 to 0.22.0 in /ext
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/auth from 0.3.0 to 0.7.0

Commits

e32ccc2 Merge pull request #763 from fluxcd/kubernetes-1.30
2b974af Update sigs.k8s.io/controller-tools to v0.15.0
52c1fc5 Update sigs.k8s.io/controller-runtime to v0.18.0
c906252 Update dependencies to Kubernetes 1.30
92c1348 Merge pull request #764 from fluxcd/dependabot/github_actions/ci-e44cfae560
ccb916a build(deps): bump the ci group with 3 updates
6081556 Merge pull request #761 from fluxcd/kustomize-name-prefix-suffix
abf5675 kustomize: Add support for namePrefix and nameSuffix
98d2522 Merge pull request #760 from fluxcd/dependabot/github_actions/ci-8f082d4f6d
efcd824 build(deps): bump docker/setup-buildx-action in the ci group
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.53.1 to 0.54.0

Commits

e0f6da0 Merge pull request #873 from fluxcd/lazy-restmapper
60bfc04 Update controller-runtime to v0.20.2
7c5e477 Vendor the lazy restmapper from controller-runtime v0.19
00d1ceb Merge pull request #844 from 94DanielBrown/main
13f8832 chore: add function to group entries by action in changeset output
See full diff in compare view

Updates github.com/go-git/go-git/v5 from 5.13.2 to 5.14.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.14.0

What's Changed

v5: Bump Go and dependencies to mitigate GO-2025-3487 by @pjbgf in go-git/go-git#1436

⚠️ Note that this version requires Go 1.23, due to the bump to golang.org/x/[email protected] which mitigates the CVE above. User's that can't bump to Go 1.23 will need to remain on the previous v5.13.x release.

Full Changelog: go-git/go-git@v5.13.2...v5.14.0

Commits

863c621 Merge pull request #1436 from pjbgf/v5-bumps
2e69e81 build: Bump dependencies
b2c1ec9 build: Bump Go versions
See full diff in compare view

Updates github.com/minio/minio-go/v7 from 7.0.87 to 7.0.88

Release notes

Sourced from github.com/minio/minio-go/v7's releases.

Bugfix Release

What's Changed

add replication stat counters and downtime info types by @Praveenrajmani in minio/minio-go#2071

feat: add reverse version for listObjectVersions by @jiuker in minio/minio-go#2072

New Contributors

@Praveenrajmani made their first contribution in minio/minio-go#2071

Full Changelog: minio/minio-go@v7.0.87...v7.0.88

Commits

c34f06b feat: add reverse version for listObjectVersions (#2072)
a9f9671 add replication stat counters and downtime info types (#2071)
80c3c59 Update version to next release
See full diff in compare view

Updates github.com/notaryproject/notation-go from 1.3.0 to 1.3.1

Release notes

Sourced from github.com/notaryproject/notation-go's releases.

v1.3.1

Vote PASSED [+5 -0]: #517

Bug fix

This patch release removes the timestamp check against signing time during authentic timestamp verification due to potential time skew and the unauthenticated nature of signing time field.

What's Changed

bump: release v1.3.0 by @Two-Hearts in notaryproject/notation-go#507

fix: remove signing time check during authenticTimestamp by @Two-Hearts in notaryproject/notation-go#514

bump: bump up dependencies for release-1.3 branch by @Two-Hearts in notaryproject/notation-go#516

Full Changelog: notaryproject/notation-go@v1.3.0...v1.3.1

Commits

961cef1 bump: release v1.3.1
f171fb0 bump: bump up dependencies for release-1.3 branch (#516)
540cc34 fix: remove signing time check during authenticTimestamp (#514)
1864576 Merge pull request #507 from Two-Hearts/release-1.3
See full diff in compare view

Updates github.com/prometheus/client_golang from 1.21.0 to 1.21.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.21.1 / 2025-03-04

This release addresses a performance regression introduced in #1661 -- thanks to all who reported this quickly: @chlunde, @dethi, @aaronbee @tsuna @kakkoyun 💪🏽. This patch release also fixes the iOS build.

We will be hardening the release process even further (#1759, #1761) to prevent this in future, sorry for the inconvenience!

The high concurrency optimization is planned to be eventually reintroduced, however in a much safer manner, potentially in a separate API.

[BUGFIX] prometheus: Revert of Inc, Add and Observe cumulative metric CAS optimizations (#1661), causing regressions on low concurrency cases #1757

[BUGFIX] prometheus: Fix GOOS=ios build, broken due to process_collector_* wrong build tags. #1758

Revert "exponential backoff for CAS operations on floats" and cut 1.21.1 by @bwplotka in prometheus/client_golang#1757

Fix ios build for 1.21.1 by @bwplotka in prometheus/client_golang#1758

Full Changelog: prometheus/client_golang@v1.21.0...v1.21.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.21.1 / 2025-03-04

[BUGFIX] prometheus: Revert of Inc, Add and Observe cumulative metric CAS optimizations (#1661), causing regressions on low contention cases.

[BUGFIX] prometheus: Fix GOOS=ios build, broken due to process_collector_* wrong build tags.

Commits

8a42da3 Fix ios build. (#1758)
40c62f7 Merge pull request #1757 from prometheus/revert-121cas
689f590 Cut 1.21.1
9e567a7 Revert "Add: exponential backoff for CAS operations on floats (#1661)"
See full diff in compare view

Updates github.com/sigstore/sigstore from 1.8.15 to 1.9.1

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.9.1

What's Changed

Implement default signing algorithms based on the key type by @ret2libc in sigstore/sigstore#2014

Full Changelog: sigstore/sigstore@v1.9.0...v1.9.1

v1.9.0

What's Changed

Update KMS policy for new plugin interface by @haydentherapper in sigstore/sigstore#1987

Update TUF root to latest v12 root by @haydentherapper in sigstore/sigstore#1988

build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 by @dependabot in sigstore/sigstore#1994

upgrade go-jose to v4 by @cpanato in sigstore/sigstore#2000

pkg/signature: expose Algorithm Details information by @ret2libc in sigstore/sigstore#2001

Full Changelog: sigstore/sigstore@v1.8.15...v1.9.0

Commits

760d02f build(deps): Bump golang.org/x/oauth2 in /pkg/signature/kms/gcp (#2021)
263d8ec build(deps): Bump github.com/sigstore/sigstore (#2016)
3e1a5a1 build(deps): Bump the gomod group across 1 directory with 2 updates (#2018)
9193344 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2020)
0a8c5d7 build(deps): Bump the gomod group across 1 directory with 2 updates (#2018)
3a14cfc build(deps): Bump google.golang.org/api in /pkg/signature/kms/gcp (#2022)
f577ba0 Implement default signing algorithms based on the key type (#2014)
a304698 pkg/signature: expose Algorithm Details information (#2001)
bf09332 build(deps): Bump actions/cache from 4.2.1 to 4.2.2 in the all group (#2013)
47d4326 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2011)
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.33.0 to 0.35.0

Commits

7292932 ssh: limit the size of the internal packet queue while waiting for KEX
f66f74b acme/autocert: check host policy before probing the cache
b0784b7 x509roots/fallback: drop obsolete build constraint
911360c all: bump golang.org/x/crypto dependencies of asm generators
89ff08d all: upgrade go directive to at least 1.23.0 [generated]
e47973b all: update certs for go1.24
See full diff in compare view

Updates golang.org/x/oauth2 from 0.26.0 to 0.27.0

Commits

681b4d8 jws: split token into fixed number of parts
3f78298 all: upgrade go directive to at least 1.23.0 [generated]
109dabf endpoints: add links/provider for Discord
ac571fa oauth2: fix docs for Config.DeviceAuth
314ee5b endpoints: add patreon endpoint
See full diff in compare view

Updates golang.org/x/sync from 0.11.0 to 0.12.0

Commits

b637f27 errgroup: drop support for Go versions before 1.20
960bf1f all: upgrade go directive to at least 1.23.0 [generated]
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-deps group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy) | `1.7.0` | `1.7.2` | | [github.com/fluxcd/pkg/auth](https://github.com/fluxcd/pkg) | `0.3.0` | `0.7.0` | | [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.53.1` | `0.54.0` | | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.13.2` | `5.14.0` | | [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.0.87` | `7.0.88` | | [github.com/notaryproject/notation-go](https://github.com/notaryproject/notation-go) | `1.3.0` | `1.3.1` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.21.0` | `1.21.1` | | [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.8.15` | `1.9.1` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.11.0` | `0.12.0` | Updates `github.com/elazarl/goproxy` from 1.7.0 to 1.7.2 - [Release notes](https://github.com/elazarl/goproxy/releases) - [Commits](elazarl/goproxy@v1.7.0...v1.7.2) Updates `github.com/fluxcd/pkg/auth` from 0.3.0 to 0.7.0 - [Commits](fluxcd/pkg@tar/v0.3.0...tar/v0.7.0) Updates `github.com/fluxcd/pkg/runtime` from 0.53.1 to 0.54.0 - [Commits](fluxcd/pkg@runtime/v0.53.1...runtime/v0.54.0) Updates `github.com/go-git/go-git/v5` from 5.13.2 to 5.14.0 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.13.2...v5.14.0) Updates `github.com/minio/minio-go/v7` from 7.0.87 to 7.0.88 - [Release notes](https://github.com/minio/minio-go/releases) - [Commits](minio/minio-go@v7.0.87...v7.0.88) Updates `github.com/notaryproject/notation-go` from 1.3.0 to 1.3.1 - [Release notes](https://github.com/notaryproject/notation-go/releases) - [Changelog](https://github.com/notaryproject/notation-go/blob/main/RELEASE_CHECKLIST.md) - [Commits](notaryproject/notation-go@v1.3.0...v1.3.1) Updates `github.com/prometheus/client_golang` from 1.21.0 to 1.21.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.21.0...v1.21.1) Updates `github.com/sigstore/sigstore` from 1.8.15 to 1.9.1 - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.8.15...v1.9.1) Updates `golang.org/x/crypto` from 0.33.0 to 0.35.0 - [Commits](golang/crypto@v0.33.0...v0.35.0) Updates `golang.org/x/oauth2` from 0.26.0 to 0.27.0 - [Commits](golang/oauth2@v0.26.0...v0.27.0) Updates `golang.org/x/sync` from 0.11.0 to 0.12.0 - [Commits](golang/sync@v0.11.0...v0.12.0) --- updated-dependencies: - dependency-name: github.com/elazarl/goproxy dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/auth dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/runtime dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/go-git/go-git/v5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/minio/minio-go/v7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/notaryproject/notation-go dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/prometheus/client_golang dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/sigstore/sigstore dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/sync dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2025-03-12T21:47:50Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added the dependencies Pull requests that update a dependency label Mar 11, 2025

dependabot bot closed this Mar 12, 2025

dependabot bot deleted the dependabot/go_modules/go-deps-77b3b1a3cb branch March 12, 2025 21:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the go-deps group across 1 directory with 11 updates #1748

build(deps): bump the go-deps group across 1 directory with 11 updates #1748

Uh oh!

dependabot bot commented on behalf of github Mar 11, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Mar 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

build(deps): bump the go-deps group across 1 directory with 11 updates #1748

build(deps): bump the go-deps group across 1 directory with 11 updates #1748

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.7.2

What's Changed

v1.7.1

What's Changed

v5.14.0

What's Changed

Bugfix Release

What's Changed

New Contributors

v1.3.1

Bug fix

What's Changed

v1.21.1 / 2025-03-04

1.21.1 / 2025-03-04

v1.9.1

What's Changed

v1.9.0

What's Changed

Uh oh!

dependabot bot commented on behalf of github Mar 12, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Mar 11, 2025 •

edited

Loading