[dependabot]

Bumps the go-dependencies group with 4 updates: github.com/creasty/defaults, github.com/go-sql-driver/mysql, golang.org/x/crypto and google.golang.org/grpc.

Updates github.com/creasty/defaults from 1.8.0 to 1.11.0

Release notes

Sourced from github.com/creasty/defaults's releases.

v1.11.0

v1.10.0 ended with six known issues. This release fixes three of them — data with a cycle crashed the process, a SetDefaults ran after an unmarshaler had taken the tag, and a failed default left part of itself behind — and half of a fourth: Set no longer writes to a map of slices or maps. The other two, and the rest of the fourth, stay as they are, now documented as intended. The API is unchanged, and so is go.mod.

Behavior changes come first, as before. Two of them can change what a working program does, and neither announces itself: one stops a SetDefaults call, and the other changes what Set leaves behind when it returns an error.

[BREAKING] SetDefaults is skipped behind a pointer once an unmarshaler took the tag (#97)

The README says that when a tag is handed to UnmarshalText, SetDefaults is not called. v1.10.0 made that hold for a struct, behind a pointer or not, and listed the rest as a known issue: a pointer to any other type still got SetDefaults after its unmarshaler took the tag. It no longer does:

type Level int
func (l *Level) UnmarshalText(b []byte) error {
n, err := strconv.Atoi(string(b))
if err != nil {
return err
}
*l = Level(n)
return nil
}
func (l *Level) SetDefaults() { *l += 100 }
type Config struct {
Level *Level default:"3" // v1.10.0: 103. v1.11.0: 3.
}

a field of that Level, left zero	v1.10.0	v1.11.0
*Level default:"3"	103	3
**Level default:"3"	103	3
embedded *Level default:"3"	103	3
*Level, with UnmarshalJSON in place of UnmarshalText	103	3
*Level default:"", which no unmarshaler is offered	100	100
*Level default:"0x10", which UnmarshalText rejects and parsing by kind takes	116	116
Level default:"3"	3	3

Nothing reports the missing call. How to tell whether you are affected: look for a type that is not a struct — a named int, string or slice — with both SetDefaults and UnmarshalText or UnmarshalJSON, behind a pointer a tag allocates. If its SetDefaults adjusted what the unmarshaler produced, that adjustment is gone; make it in the unmarshaler instead. A field of the type itself never got the call, and a pointer the caller allocated is still left alone.

[BREAKING] A failed default no longer leaves part of itself behind (#98)

When a default failed, Set returned the error but kept what it had filled on the way down. The value was then no longer zero, so a second Set could skip the tag and return nil, which v1.10.0 listed as a known issue for *scalar, *[]T and *map fields. Now each value Set found zero on the way to the failing default is put back to zero, whatever part of the default it had taken:

after Set returned the error	v1.10.0	v1.11.0
*int default:"eighty"	&0, and a second Set returns nil	nil, and a second Set returns the error again
*[]string default:"[1]"	&[], and a second Set returns nil	nil, and a second Set returns the error again
a struct field default:"{\"X\": 1, \"Y\": \"two\"}"	{X:1 Y:0}	{X:0 Y:0}
an untagged struct field whose A took 7 before B failed	{A:7 B:0}	{A:0 B:0}

... (truncated)

Commits

• 10a16ef refactor: read tag.value in fillField rather than aliasing it (#112)
• 08a42cd refactor: move the internal packages back into files (#111)
• 5012535 refactor: move the unmarshaler handoff to internal/unmarshal (#110)
• 120766a Move the promoted-method check to internal/method (#109)
• dc07feb perf: check a value deep in the path against an index, not a scan (#108)
• 702f9a4 perf: skip joining the int64 parsers' errors for an empty tag (#107)
• 31d8cbc test: pin a caller's pointer to a slice, map or pointer as a QUIRK (#106)
• 6852e14 fix: store only a struct copy back into the map holding it (#105)
• 6545f75 fix: end a cycle in the caller's data instead of overflowing the stack (#104)
• b9efcfb perf: skip walking a slice or map whose elements cannot hold defaults (#103)
• Additional commits viewable in compare view

Updates github.com/go-sql-driver/mysql from 1.10.0 to 1.10.1

Release notes

Sourced from github.com/go-sql-driver/mysql's releases.

v1.10.1

What's Changed

• dsn: default Net to tcp in NewConfig so Addr-only configs round-trip by @​c-tonneslan in go-sql-driver/mysql#1770
• Add LTS MariaDB 11.8 and 12.3 into the testing matrix by @​pgporada in go-sql-driver/mysql#1774
• Bump actions/checkout from 6 to 7 in the all-dependencies group by @​dependabot[bot] in go-sql-driver/mysql#1777
• ci: pin actions by @​methane in go-sql-driver/mysql#1778
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1779
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1780
• Interpolate typed-nil json.RawMessage as NULL by @​oha-4 in go-sql-driver/mysql#1782
• Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group by @​dependabot[bot] in go-sql-driver/mysql#1783
• Bump the all-dependencies group across 1 directory with 5 updates by @​dependabot[bot] in go-sql-driver/mysql#1791
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1794
• Bump the all-dependencies group with 5 updates by @​dependabot[bot] in go-sql-driver/mysql#1795
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1796
• codeql: remove custom workflow by @​methane in go-sql-driver/mysql#1799
• doc: clarify timeTruncate units and when to use it by @​milanobrtlik in go-sql-driver/mysql#1792
• release v1.10.1 by @​methane in go-sql-driver/mysql#1801

New Contributors

• @​c-tonneslan made their first contribution in go-sql-driver/mysql#1770
• @​oha-4 made their first contribution in go-sql-driver/mysql#1782
• @​milanobrtlik made their first contribution in go-sql-driver/mysql#1792

Full Changelog: go-sql-driver/mysql@v1.10.0...v1.10.1

Changelog

Sourced from github.com/go-sql-driver/mysql's changelog.

v1.10.1 (2026-09-02)

• Fix Config.FormatDSN() dropping Addr when Net is empty. It now uses the default tcp network so configs with only Addr round-trip correctly. (#1770)

• Fix typed-nil json.RawMessage with interpolateParams=true being interpolated as an empty string. It is now interpolated as SQL NULL, matching server-side prepared statements. (#1782)

• Add MariaDB 11.8 and 12.3 to the test matrix. (#1774)

Commits

• 7ca26e8 release v1.10.1 (#1801)
• 87dcb95 doc: clarify timeTruncate units and when to use it (#1792)
• 1d9c421 codeql: remove custom workflow (#1799)
• 532b8e5 Bump the all-dependencies group with 3 updates (#1796)
• fe209cc Bump the all-dependencies group with 5 updates (#1795)
• 03d76c7 Bump the all-dependencies group with 3 updates (#1794)
• c426bd9 Bump the all-dependencies group across 1 directory with 5 updates (#1791)
• 416cd99 Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group (#1783)
• b96d415 Interpolate typed-nil json.RawMessage as NULL (#1782)
• dec193d Bump the all-dependencies group with 3 updates (#1780)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.55.0 to 0.57.0

Commits

• 3f62bf1 go.mod: update golang.org/x dependencies
• 86efde5 ssh: reject unexpected message types on established channels
• a6cdac6 ssh: drop traffic on undecided channels
• 39dc44e ssh: don't skip the source-address critical option in CheckCert
• afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
• 89f4e9b x509roots/fallback: update bundle
• 71488c4 ssh/knownhosts: compare only public key portions for revocation
• 82adefa ssh: synchronize unexpected response test
• c757c98 all: upgrade go directive to at least 1.26.0 [generated]
• 593c81a ssh: correctly ignore pre-banner lines
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.83.2 to 1.84.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.84.0

Behavior Changes

• stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

• xds: Add support for contains_match in route header matchers. (#9223)
  • Special Thanks: @​nvxbug

Bug Fixes

• client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)
  • Special Thanks: @​utkuozdemir
• client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)
  • Special Thanks: @​chengxilo
• credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)
  • Special Thanks: @​buger
• credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)
  • Special Thanks: @​nvxbug
• randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)
  • Special Thanks: @​fallintoplace
• stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)
• transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)
  • Special Thanks: @​buger
• transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)
  • Special Thanks: @​buger
• xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#9140)
• xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#9223)
  • Special Thanks: @​nvxbug
• xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#9223)
  • Special Thanks: @​nvxbug
• xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#9257)
  • Special Thanks: @​nvxbug
• xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#9218)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#9250)
  • Special Thanks: @​nvxbug

Performance Improvements

• transport: Avoid a heap allocation when flushing shared write buffers. (#9233)
  • Special Thanks: @​zaidoon1
• credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)

Commits

• e84aa5a Change version to 1.84.0 (#9324)
• c5ae88d Cherrypick #9204 and #9321 to v1.84.x (#9407)
• a592f6a Cherrypick #9351 and #9404 to v1.84.x (#9408)
• d5a4111 cherry-pick #9365 to v1.84.x (#9370)
• 89d55e0 cherry-pick #9346 to v1.84.x (#9372)
• 8a9f866 Cherry-pick #9332 to v1.84.x (#9338)
• f8b54e7 Cherry-pick #9331 to v1.84.x (#9334)
• 30ce1d5 xds: support injecting bootstrap and server config into HTTP filter config pa...
• 54c743e extproc : wait for async RPC to complete in test (#9311)
• 538bb2f endpointsharding: decouple locking, and simplify ChildState API (#9290)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions