Skip to content

chore(go): Bump the go-dependencies group with 7 updates - #45

Merged
kemingy merged 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-87b7caf553
Nov 2, 2026
Merged

chore(go): Bump the go-dependencies group with 7 updates#45
kemingy merged 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-87b7caf553

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 7 updates:

Package From To
github.com/klauspost/compress 1.20.0 1.20.3
github.com/phuslu/log 1.0.134 1.0.138
github.com/tidwall/gjson 1.19.0 1.20.0
go.opentelemetry.io/proto/otlp 1.11.0 1.11.1
golang.org/x/net 0.59.0 0.61.0
golang.org/x/sys 0.48.0 0.49.0
google.golang.org/grpc 1.83.2 1.84.0

Updates github.com/klauspost/compress from 1.20.0 to 1.20.3

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.20.3

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.20.1...v1.20.3

v1.20.2

Full Changelog: klauspost/compress@v1.20.1...v1.20.2

v1.20.1

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.20.0...v1.20.1

Commits
  • b946d41 Revert #1255 (#1261)
  • 748550b Merge commit from fork
  • dd54d86 huff0: reuse Scratch across inputs in the fuzzers (#1257)
  • d189b4c gzhttp: do not compress 206 responses without Content-Range, read Accept-Enco...
  • 6b91995 zstd, huff0: keep the encoder bit writers in registers (#1245)
  • 402c3a5 s2: Reject short index chunk in RemoveIndexHeaders (#1254)
  • 29f5f81 build(deps): bump the github-actions group with 4 updates (#1252)
  • 9b8ba61 dict: Stricter input validation (#1250)
  • da4df9c zstd: decode at full speed into exact-size destinations (#1246)
  • 1971eec reject zip entries named "." in ReadDir (#1249)
  • Additional commits viewable in compare view

Updates github.com/phuslu/log from 1.0.134 to 1.0.138

Commits
  • fc739ba fix: preserve entries shared by asynchronous writers
  • f0bc542 stop the slog group rollback loop when no key is left
  • 15ef83a drop empty slog groups instead of writing past the buffer
  • dd7406f correct FileWriter.MaxBackups behavior
  • b0c39e4 Revert "fix file writer comment"
  • 4b43135 use range over int for the remaining counter loops
  • 0eb42df fix the journal writer nil socket and the connect race
  • c88de06 fix inverted handle check that disabled the eventlog writer
  • 94efb5a fix file writer comment
  • 7f9d1b3 set AsyncWriter ChannelSize to 1024 by default
  • Additional commits viewable in compare view

Updates github.com/tidwall/gjson from 1.19.0 to 1.20.0

Commits
  • 690362d Deprecate DisableModifiers and DisableEscapeHTML globals
  • b91555e nl at 80
  • b603eb1 Cleanup and modernize
  • 9378d3b Fix Result.Path panics
  • 8d89927 Ensure floating points are correctly being clipped
  • eaae8c6 Fix large number overflows for Int() and Uint()
  • 6ac9851 Change utf8 behavior for invalid codepoints
  • 5fc5c04 Update README.md
  • 7d8b382 Update README.md
  • 896d569 Update gjson.go
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/proto/otlp from 1.11.0 to 1.11.1

Release notes

Sourced from go.opentelemetry.io/proto/otlp's releases.

v1.11.1/v0.4.1

Generated Go code for the v1.11.1 version of the OTLP.

What's Changed

... (truncated)

Commits
  • 56a07c4 Release v1.11.1 (#724)
  • 5f91619 chore(deps): update module github.com/protonmail/go-crypto to v1.5.2 (#721)
  • 3354765 chore(deps): update open-telemetry/shared-workflows action to v0.17.0 (#722)
  • 63fe26d chore(deps): update googleapis to 8a89bd6 (#723)
  • 1b6d220 fix(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.31.0...
  • 10f903e chore(deps): update module github.com/protonmail/go-crypto to v1.5.1 (#719)
  • 9a22ab7 chore(deps): update module github.com/protonmail/go-crypto to v1.5.0 (#718)
  • a448d91 chore(deps): update open-telemetry/shared-workflows action to v0.16.0 (#717)
  • 0dc2393 chore(deps): update open-telemetry/shared-workflows action to v0.15.0 (#716)
  • 47c34ef chore(deps): update googleapis to b142276 (#715)
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.59.0 to 0.61.0

Commits
  • c1d31df go.mod: update golang.org/x dependencies
  • 8456a20 quic: properly check for allowed frame types in a packet
  • 18ece0c http2: prevent crash due to HPACK encoder race
  • 2d03f9d http2: avoid 2x refund on stream close with buffered data
  • cc7d34f http2: avoid excessive work on initial window changes
  • 57f4235 http2: apply header limits to Trailer headers too
  • 01e3d03 http2: coalesce dials via wrapped Transport.RoundTrip
  • 2824783 http2: delete malformed framing-related headers
  • b13c0c1 internal/http3: delete HTTP/3 package
  • 520c891 quic: off-path support in loss/congestion/rtt
  • Additional commits viewable in compare view

Updates golang.org/x/sys from 0.48.0 to 0.49.0

Commits
  • b6b8557 unix/linux: unify ppc64x syscall wrappers
  • aab6988 unix: add PrctlArg5Ptr
  • cdfd984 unix: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on darwin
  • 782b836 unix/linux: don't warn about closed stderr from child process
  • 61592fb unix: return syscall error in *listxattrNS on BSD
  • c136fda unix/linux/Dockerfile: update to Go 1.26.8
  • f1d0d79 unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls
  • 67f850b unix: update linux to v7.2
  • eb1f659 unix: add O_EXEC and O_SEARCH on darwin
  • 51bc731 unix: add Mmsghdr for linux
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.83.2 to 1.84.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.84.0

Behavior Changes

  • stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

  • xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

  • client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)
  • client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)
  • credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)
  • credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)
  • randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)
  • stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)
  • transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)
  • transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)
  • xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#9140)
  • xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#9223)
  • xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#9223)
  • xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#9257)
  • xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#9218)
  • xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)
  • xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#9258)
  • xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#9250)

Performance Improvements

  • transport: Avoid a heap allocation when flushing shared write buffers. (#9233)
  • credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(go): Bump the go-dependencies group with 7 updates
0121680 
Bumps the go-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/klauspost/compress](https://github.com/klauspost/compress) | `1.20.0` | `1.20.3` |
| [github.com/phuslu/log](https://github.com/phuslu/log) | `1.0.134` | `1.0.138` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.19.0` | `1.20.0` |
| [go.opentelemetry.io/proto/otlp](https://github.com/open-telemetry/opentelemetry-proto-go) | `1.11.0` | `1.11.1` |
| [golang.org/x/net](https://github.com/golang/net) | `0.59.0` | `0.61.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.48.0` | `0.49.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.83.2` | `1.84.0` |


Updates `github.com/klauspost/compress` from 1.20.0 to 1.20.3
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.20.0...v1.20.3)

Updates `github.com/phuslu/log` from 1.0.134 to 1.0.138
- [Commits](phuslu/log@v1.0.134...v1.0.138)

Updates `github.com/tidwall/gjson` from 1.19.0 to 1.20.0
- [Commits](tidwall/gjson@v1.19.0...v1.20.0)

Updates `go.opentelemetry.io/proto/otlp` from 1.11.0 to 1.11.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-proto-go/releases)
- [Commits](open-telemetry/opentelemetry-proto-go@v1.11.0...v1.11.1)

Updates `golang.org/x/net` from 0.59.0 to 0.61.0
- [Commits](golang/net@v0.59.0...v0.61.0)

Updates `golang.org/x/sys` from 0.48.0 to 0.49.0
- [Commits](golang/sys@v0.48.0...v0.49.0)

Updates `google.golang.org/grpc` from 1.83.2 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.2...v1.84.0)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.20.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/phuslu/log
  dependency-version: 1.0.138
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/tidwall/gjson
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/proto/otlp
  dependency-version: 1.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/grpc
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 1, 2026
@kemingy
kemingy merged commit cd5e2da into main Nov 2, 2026
3 checks passed
@kemingy
kemingy deleted the dependabot/go_modules/go-dependencies-87b7caf553 branch November 2, 2026 15:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@kemingy kemingy

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kemingy