Skip to content

deps(deps): bump the go-dependencies group across 1 directory with 9 updates - #169

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-9b7aa9c1f4
Closed

deps(deps): bump the go-dependencies group across 1 directory with 9 updates#169
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-9b7aa9c1f4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 5 updates in the / directory:

Package From To
github.com/nats-io/nats-server/v2 2.14.1 2.14.3
github.com/antithesishq/antithesis-sdk-go 0.7.0 0.7.2
github.com/klauspost/compress 1.18.6 1.19.0
github.com/prometheus/common 0.68.0 0.69.0
github.com/prometheus/procfs 0.20.1 0.21.1

Updates github.com/nats-io/nats-server/v2 from 2.14.1 to 2.14.3

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.14.3

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version

Dependencies

  • golang.org/x/crypto v0.53.0 (#8297)
  • golang.org/x/sys v0.46.0 (#8297)
  • github.com/nats-io/jwt/v2 v2.8.2
  • github.com/nats-io/nkeys v0.4.16

Improved

General

  • Per-connection log lines that could be noisy in normal operation have been demoted to debug level (#8289)
  • Writer options are now applied consistently when using the s2_fast compression mode (#8047)

JetStream

  • Stream and consumer assignment handling has been refactored for more consistent migration and info behavior (#8262)
  • Meta, stream and consumer write errors are now registered more consistently for health and recovery handling (#8293)

Removed

Monitoring

  • JSONP callback support has been removed from monitoring endpoints

Fixed

General

  • Long-running reconnect and OCSP loops no longer retain unused timers, reducing memory pressure over time (#8204)
  • Inherited JWT default permissions are now refreshed when account claims are updated (#8276)
  • External auth configuration is now cleared correctly when account claims are updated (#8275)
  • PROXY protocol detection, TLS sniffing with allow_non_tls and PROXY v1 address-family parsing have been fixed (#8302)
  • A race in gateway CONNECT handling has been fixed (#8306)
  • Trusted proxy tracking no longer leaks closed clients during concurrent updates (#8307)
  • Service import replies can now be delivered across cluster routes (#8317)
  • Message tracing now works correctly with service imports and exports
  • Several panic, fatal and data race conditions in authentication, routing, monitoring and clustered request handling have been fixed
  • NoAuthUser now checks connection restrictions
  • Leaf connections no longer bypass Nats-Trace-Dest publish permission checks
  • CONNZ and SUBSZ pagination now guard against Offset and Limit integer overflow panics

... (truncated)

Commits
  • 9b17a58 Release v2.14.3
  • 2be2525 Release v2.14.3-RC.2
  • 563d55f Cherry-picks for v2.14.3-RC.2 (#126)
  • e242ca0 NRG: Don't campaign with an uncommitted membership change about ourselves
  • 0e4d935 NRG: Exclude uncommitted membership change from snapshot
  • 0ab7302 NRG: Remove redundant known peer tracking
  • 6eb7d76 NRG: Truncated uncommitted membership change leaves stale state
  • 8157b56 [TEST] Campaign early on NRG tests
  • 712b3d2 [FIXED] Nil pointer panic when resolver dir parent is not traversable
  • f11c26b [FIXED] Skipped messages set last time to now
  • Additional commits viewable in compare view

Updates github.com/antithesishq/antithesis-sdk-go from 0.7.0 to 0.7.2

Changelog

Sourced from github.com/antithesishq/antithesis-sdk-go's changelog.

0.7.2 - 2026-05-13

Fix PathFromBaseDirectory mispathing multi-level submodules. Its filepath.Match pattern was baseDir/*, which does not cross path separators — so any customer submodule nested two or more levels deep had its modified go.mod written to customer/<input-abspath>/... instead of customer/<rel-path>/.... Now uses filepath.Rel. Affected any non-trivial Go monorepo (etcd, k8s, etc.) since the instrumented output of deep submodules was non-functional. (ENG-3940)

0.7.1 - 2026-05-13

Fix the instrumentor leaking the host's Go version into the notifier module's go.mod, which caused go mod tidy to bump every customer module's go directive (and drop toolchain) just because it now required the notifier. The notifier's go directive is now pinned to the minimum across the customer modules the instrumentor touches, and toolchain is omitted.

Commits
  • 2377e2a Merge pull request #42 from antithesishq/jeskew/instrumentation-fixes
  • 7b59cab Update instrumentor to better handle nested modules
  • dff25ac Refactoring Go instrumentor - splitting out the AST traversal
  • 6d51fe6 Make the decision about WantsInstrumentor (or not) in main()
  • 7ee7642 Fixing CI
  • dda77ab Refactoring how logging works in the Go instrumentor.
  • 44576ae Refactoring how we deal with Config in the Go Instrumentor.
  • 0fa05c2 Adding CHANGELOG.md
  • 5bad9d2 Refactoring package structure
  • See full diff in compare view

Updates github.com/klauspost/compress from 1.18.6 to 1.19.0

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.19.0

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

v1.18.7

  • Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

Commits

Updates github.com/nats-io/jwt/v2 from 2.8.1 to 2.8.2

Release notes

Sourced from github.com/nats-io/jwt/v2's releases.

v2.8.2

What's Changed

Full Changelog: nats-io/jwt@v2.8.1...v2.8.2

Commits

Updates github.com/nats-io/nkeys from 0.4.15 to 0.4.16

Release notes

Sourced from github.com/nats-io/nkeys's releases.

v0.4.16

What's Changed

Full Changelog: nats-io/nkeys@v0.4.15...v0.4.16

Commits
  • c1eebf3 Merge pull request #87 from nats-io/bump
  • 9e2706c bumped version
  • d071bc9 Merge pull request #86 from nats-io/daniele/check-public-key-len
  • b2262fd chore: bump go to 1.25 for staticcheck latest
  • 77a71f8 Validate decoded seed length in DecodeSeed
  • 57bc753 Validate public key length before ed25519 verify
  • See full diff in compare view

Updates github.com/prometheus/common from 0.68.0 to 0.69.0

Release notes

Sourced from github.com/prometheus/common's releases.

v0.69.0

What's Changed

Full Changelog: prometheus/common@v0.68.1...v0.69.0

v0.68.1

What's Changed

Full Changelog: prometheus/common@v0.68.0...v0.68.1

Changelog

Sourced from github.com/prometheus/common's changelog.

v0.69.0 / 2026-06-17

Security / behavior changes

  • config: credentials are no longer forwarded across cross-host redirects. When FollowRedirects is enabled, the HTTP client now strips Authorization, Cookie, Proxy-Authorization and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's net/http behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. #901 #920 #921
  • config: LoadHTTPConfigFile now resolves relative file paths (e.g. *_file credentials, http_headers files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. #925

Bugfixes

  • expfmt: fix nil pointer panic when parsing empty braces {}. #922
  • model: fix Time.UnmarshalJSON for larger negative numbers. #918

Performance

  • model: reduce allocations in Time.UnmarshalJSON. #918

Internal

  • Synchronize common files from prometheus/prometheus. #917
  • Modernize Go. #919

Full Changelog: prometheus/common@v0.68.1...v0.69.0

v0.67.2 / 2025-10-28

What's Changed

New Contributors

Full Changelog: prometheus/common@v0.67.1...v0.67.2

v0.67.1 / 2025-10-07

What's Changed

Full Changelog: prometheus/common@v0.67.0...v0.67.1

v0.67.0 / 2025-10-07

What's Changed

... (truncated)

Commits
  • e3c14a0 Merge pull request #925 from roidelapluie/roidelapluie/fix-loadhttpconfigfile...
  • a7b791d config: resolve LoadHTTPConfigFile paths relative to the config file
  • f84efec Merge pull request #918 from prometheus/time-split
  • 2269d3d Merge pull request #922 from roidelapluie/roidelapluie/fix-textparse-empty-br...
  • a1600af expfmt: fix nil pointer panic when parsing empty braces "{}"
  • 56fe395 Merge pull request #921 from roidelapluie/roidelapluie/oauth2-cross-host-check
  • 0fcda47 Merge pull request #920 from roidelapluie/roidelapluie/cross-host-sticky
  • 30ba470 Merge pull request #919 from prometheus/superq/modernize
  • 2b55b3e config: check cross-host redirect before OAuth2 token fetch
  • 428856f config: make isCrossHostRedirect sticky across the redirect chain
  • Additional commits viewable in compare view

Updates github.com/prometheus/procfs from 0.20.1 to 0.21.1

Release notes

Sourced from github.com/prometheus/procfs's releases.

v0.21.0

What's Changed

New Contributors

Full Changelog: prometheus/procfs@v0.20.1...v0.21.0

Commits

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits
  • 45460e0 go.mod: update golang.org/x dependencies
  • d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
  • e2ffffe ssh: reject incomplete gssapi-with-mic configurations
  • 60e158a ssh/test: isolate CLI tests from user SSH config and agent
  • 1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
  • 3872a2b ssh/knownhosts: verify declared key type matches decoded key
  • 9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
  • 8f405a4 ssh: validate ECDSA curve matches expected algorithm
  • bb41b3d ssh: improve DH GEX group selection using PreferredBits
  • e04e721 ssh/agent: validate ed25519 private key length in Add
  • Additional commits viewable in compare view

Updates golang.org/x/sys from 0.45.0 to 0.46.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(deps): bump the go-dependencies group across 1 directory with 9 …
da4a901 
…updates

Bumps the go-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.14.1` | `2.14.3` |
| [github.com/antithesishq/antithesis-sdk-go](https://github.com/antithesishq/antithesis-sdk-go) | `0.7.0` | `0.7.2` |
| [github.com/klauspost/compress](https://github.com/klauspost/compress) | `1.18.6` | `1.19.0` |
| [github.com/prometheus/common](https://github.com/prometheus/common) | `0.68.0` | `0.69.0` |
| [github.com/prometheus/procfs](https://github.com/prometheus/procfs) | `0.20.1` | `0.21.1` |



Updates `github.com/nats-io/nats-server/v2` from 2.14.1 to 2.14.3
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](nats-io/nats-server@v2.14.1...v2.14.3)

Updates `github.com/antithesishq/antithesis-sdk-go` from 0.7.0 to 0.7.2
- [Changelog](https://github.com/antithesishq/antithesis-sdk-go/blob/main/CHANGELOG.md)
- [Commits](antithesishq/antithesis-sdk-go@v0.7.0...v0.7.2)

Updates `github.com/klauspost/compress` from 1.18.6 to 1.19.0
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.18.6...v1.19.0)

Updates `github.com/nats-io/jwt/v2` from 2.8.1 to 2.8.2
- [Release notes](https://github.com/nats-io/jwt/releases)
- [Changelog](https://github.com/nats-io/jwt/blob/main/ReleaseNotes.md)
- [Commits](nats-io/jwt@v2.8.1...v2.8.2)

Updates `github.com/nats-io/nkeys` from 0.4.15 to 0.4.16
- [Release notes](https://github.com/nats-io/nkeys/releases)
- [Commits](nats-io/nkeys@v0.4.15...v0.4.16)

Updates `github.com/prometheus/common` from 0.68.0 to 0.69.0
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md)
- [Commits](prometheus/common@v0.68.0...v0.69.0)

Updates `github.com/prometheus/procfs` from 0.20.1 to 0.21.1
- [Release notes](https://github.com/prometheus/procfs/releases)
- [Commits](prometheus/procfs@v0.20.1...v0.21.1)

Updates `golang.org/x/crypto` from 0.52.0 to 0.53.0
- [Commits](golang/crypto@v0.52.0...v0.53.0)

Updates `golang.org/x/sys` from 0.45.0 to 0.46.0
- [Commits](golang/sys@v0.45.0...v0.46.0)

---
updated-dependencies:
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/antithesishq/antithesis-sdk-go
  dependency-version: 0.7.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.19.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/nats-io/jwt/v2
  dependency-version: 2.8.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/nats-io/nkeys
  dependency-version: 0.4.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/prometheus/common
  dependency-version: 0.69.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/prometheus/procfs
  dependency-version: 0.21.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.53.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.46.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 27, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-dependencies-9b7aa9c1f4 branch July 27, 2026 09:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants