Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 13 updates#660

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-34ebdbf43d
Open

chore(deps): bump the minor-and-patch group across 1 directory with 13 updates#660
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-34ebdbf43d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 19, 2026

Copy link
Copy Markdown

Bumps the minor-and-patch group with 8 updates in the / directory:

Package From To
github.com/beevik/etree 1.6.0 1.7.0
github.com/coreos/go-oidc/v3 3.19.0 3.20.0
github.com/go-chi/chi/v5 5.3.0 5.3.1
github.com/go-ldap/ldap/v3 3.4.13 3.4.14
github.com/mattn/go-sqlite3 1.14.47 1.14.48
github.com/sethvargo/go-password 0.3.1 0.4.0
go.etcd.io/etcd/client/v3 3.6.13 3.7.0
google.golang.org/grpc 1.82.0 1.82.1

Updates github.com/beevik/etree from 1.6.0 to 1.7.0

Release notes

Sourced from github.com/beevik/etree's releases.

Release 1.7.0

Breaking changes

  • To address a security issue, it was necessary to add a MaxDepth option to ReadSettings to limit the depth of XML trees during parsing. A generous default value of 1024 was chosen to avoid breaking most existing code. However, if your code is processing XML hierarchies with a depth greater than 1024, you will need to assign your Document a ReadSettings that has a MaxDepth set to a higher value.

Security Fixes

  • Limited the depth of XML trees processed by all ReadFrom functions during parsing.
  • Fixed a CompilePath index-out-of-range panic that could be caused by a missing path filter key.
  • Sanitized the contents of XML text, comment, ProcInst and Directive tokens provided by the user.
Changelog

Sourced from github.com/beevik/etree's changelog.

Release 1.7.0

Changes

Breaking changes

  • To address a security issue, it was necessary to add a MaxDepth option to ReadSettings to limit the depth of XML trees during parsing. A generous default value of 1024 was chosen to avoid breaking most existing code. However, if your code is processing XML hierarchies with a depth greater than 1024, you will need to assign your Document a ReadSettings that has a MaxDepth set to a higher value.

Security Fixes

  • Limited the depth of XML trees processed by all ReadFrom functions during parsing.
  • Fixed a CompilePath index-out-of-range panic that could be caused by a missing path filter key.
  • Sanitized the contents of XML text, comment, ProcInst and Directive tokens provided by the user.
Commits
  • 51e79d6 Release v1.7.0
  • 236bb93 Document duplication bug fix
  • 1215e0a Enforce maximum XML tree depth during parsing
  • 936bc58 Sanitize XML contents provided by callers
  • 62d8a79 Fix CompilePath index-out-of-range panic
  • See full diff in compare view

Updates github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0

Release notes

Sourced from github.com/coreos/go-oidc/v3's releases.

v3.20.0

What's Changed

Full Changelog: coreos/go-oidc@v3.19.0...v3.20.0

Commits
  • 75dfa5c oidc: add constants for "email" and "profile" scopes
  • a89f046 oidc: add API for determining when issuer URLs mismatch
  • 6a69b6d readme: update README and docs
  • f9049c9 oidc: ignore JWKs with unknown signing algorithms rather than failing
  • 2f178e0 SECURITY.md: add a security policy and point to project-level reporting
  • b3bc7da oidc: improve documentation for APIs
  • 0db9053 oidc: modernize with new Go APIs
  • See full diff in compare view

Updates github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.1

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

Commits
  • 8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
  • caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
  • 7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
  • 878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
  • d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
  • 3b50c7c Tidy build directives (#1113)
  • 2b9fca2 Honor Discard() in httpFancyWriter.ReadFrom (#1110)
  • See full diff in compare view

Updates github.com/go-ldap/ldap/v3 from 3.4.13 to 3.4.14

Release notes

Sourced from github.com/go-ldap/ldap/v3's releases.

v3.4.14

I want to thank everyone who contributed in the recents months. Compared to last year, the number of activities and PRs (including open ones) has increased dramatically. I would like to thank everyone who contributed to the project.

Personal note: Please keep in mind that this project is not funded or supported by a large company or similar organization. We work on the library in our free time after work. I appreciate your support, but please keep this in mind (including with other open-source projects).

What's Changed

New Contributors

Full Changelog: go-ldap/ldap@v3.4.13...v3.4.14

Commits
  • 9e343e2 chore: update dependencies (#620)
  • c381fd4 fix: guard constructed-form attributeType in server-side sort decode (#618)
  • be69007 fix: guard nil responseValue when parsing WhoAmI result (#617)
  • d6d6b04 fix: prevent SearchAsync goroutine leak when context is cancelled during send...
  • c90b197 decode extended responseName by context class (#605)
  • ab9c0c1 guard malformed responseValue decode in PasswordModify (#614)
  • 8656c7a chore(deps): bump golang.org/x/net from 0.50.0 to 0.55.0 in /v3 (#613)
  • 8a98971 handle linear whitespace in digest-md5 challenge parser (#607)
  • 0059675 fix: guard malformed paging control in DecodeControl (#611)
  • 189d84e fix: skip empty referral sequence in getReferral (#610)
  • Additional commits viewable in compare view

Updates github.com/mattn/go-sqlite3 from 1.14.47 to 1.14.48

Release notes

Sourced from github.com/mattn/go-sqlite3's releases.

1.14.48

What's Changed

... (truncated)

Commits
  • 0cfec60 Merge pull request #1427 from mattn/sqlite-amalgamation-3053003
  • 603b1ba Upgrade SQLite to version 3053003
  • 3be2bdb Merge pull request #1426 from mattn/fix-load-extension-errmsg-leak
  • 7a3f560 Merge pull request #1425 from mattn/fix-trampoline-abi
  • a5fd1f6 Merge pull request #1424 from mattn/fix-preupdate-null-deref
  • 66371d2 Merge pull request #1423 from mattn/fix-open-error-leak
  • b55096d Merge pull request #1418 from mattn/add-coderabbit-config
  • fa5cf80 Merge pull request #1422 from mattn/fix-bind-unsupported-type
  • 08a4ce4 Add regression tests for bind error paths
  • ca77cf4 Merge pull request #1421 from mattn/fix-callback-named-types
  • Additional commits viewable in compare view

Updates github.com/sethvargo/go-password from 0.3.1 to 0.4.0

Release notes

Sourced from github.com/sethvargo/go-password's releases.

v0.4.0

What's changed

Modernizes the library for Go 1.25.

Breaking / behavior changes

  • Requires Go 1.25 (dropped the pinned toolchain).
  • Generate now returns the new exported ErrNegativeInput when numDigits or numSymbols is negative. Previously Generate(10, -3, 0, false, false) computed chars = 10 - (-3) - 0 = 13 and silently returned a 13-character password instead of the requested length.

Fixes

  • Fixed the broken README Actions badge (deprecated shields.io endpoint), the dead godoc.org link, and the dead AgileBits discussion link.
  • Fixed a non-constant format string (log.Printf(res) -> log.Print(res)) in the package doc comment and README.

Tooling

  • Replaced golangci-lint with a make test CI job across macOS/Ubuntu/Windows, with actions SHA-pinned via ratchet.

Full changelog: sethvargo/go-password@v0.3.1...v0.4.0

Commits

Updates go.etcd.io/etcd/client/v3 from 3.6.13 to 3.7.0

Release notes

Sourced from go.etcd.io/etcd/client/v3's releases.

v3.7.0

Please check out CHANGELOG for a full list of changes. And make sure to read upgrade guide before upgrading etcd (there may be breaking changes).

For installation guides, please check out operating etcd. Latest support status for common architectures and operating systems can be found at supported platforms.

Linux
ETCD_VER=v3.7.0
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
/tmp/etcd-download-test/etcd --version
/tmp/etcd-download-test/etcdctl version
/tmp/etcd-download-test/etcdutl version
start a local etcd server
/tmp/etcd-download-test/etcd
write,read to etcd
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo

macOS (Darwin)
ETCD_VER=v3.7.0
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64
</tr></table>

... (truncated)

Commits
  • 4d71f7c version: bump up to 3.7.0
  • b4bbb7c Merge pull request #22058 from ivanvc/release-3.7-go-1.26.5-bump
  • 2d6d9a0 Bump go toolchain to 1.26.5
  • e1fd700 Merge pull request #22031 from ivanvc/release-3.7-x-net-bump-to-0.55.0
  • f2280ae dependency: bump golang.org/x/net from 0.54.0 to 0.55.0
  • 7a64574 Merge pull request #22024 from ahrtr/20260701_crl_3.7
  • d227a3c Reject the client request if the client certificate has been revoked
  • 18f048e Merge pull request #22009 from ahrtr/20260629_deps_3.7
  • 721e394 Bump go.etcd.io/raft/v3 to v3.7.0
  • b0a329a Bump go.etcd.io/bbolt to v1.5.0
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.53.0 to 0.54.0

Commits
  • cdce021 go.mod: update golang.org/x dependencies
  • d9474cc openpgp: make the deprecation message more explicit
  • 7626c50 ssh: verify declared key type matches decoded key in authorized_keys
  • 0471e79 ssh/agent: enforce strict limits on DSA key parameters
  • 6435c37 ssh: sanitize client disconnect messages
  • 7d695da ssh/agent: drain channel stderr in agent forwarders
  • 5b7f841 acme/autocert: fix data race in Manager.createCert
  • 0b316e7 argon2: update RFC 9106 parameter recommendations
  • 55aec0a x509roots/fallback: update bundle
  • 5f2de1a internal: remove wycheproof tests
  • See full diff in compare view

Updates golang.org/x/sync from 0.21.0 to 0.22.0

Commits

Updates golang.org/x/sys from 0.46.0 to 0.47.0

Commits
  • 9e7e939 cpu: handle vendor suffixes in parseRelease
  • f6fb8a1 unix: use epoll_pwait rather than epoll_wait
  • f3eeabf windows: avoid length overflow in NewNTString
  • 3cb6647 unix: update glibc to 2.43
  • c507910 windows: document safe usage of TrusteeValue
  • See full diff in compare view

Updates golang.org/x/term from 0.44.0 to 0.45.0

Commits

Updates golang.org/x/text from 0.38.0 to 0.40.0

Commits
  • 724af9c go.mod: update golang.org/x dependencies
  • bf5b9d6 internal/export/idna: always treat Punycode encoding pure ASCII as an error
  • b326f3d go.mod: update golang.org/x dependencies
  • 5ae8e57 unicode/norm: avoid infinite loop on invalid input
  • 0dc94a2 all: fix some comments
  • See full diff in compare view

Updates google.golang.org/grpc from 1.82.0 to 1.82.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.82.1

Security

  • server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
  • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
  • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 1…
c2a0b0f 
…3 updates

Bumps the minor-and-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/beevik/etree](https://github.com/beevik/etree) | `1.6.0` | `1.7.0` |
| [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) | `3.19.0` | `3.20.0` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.3.0` | `5.3.1` |
| [github.com/go-ldap/ldap/v3](https://github.com/go-ldap/ldap) | `3.4.13` | `3.4.14` |
| [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.47` | `1.14.48` |
| [github.com/sethvargo/go-password](https://github.com/sethvargo/go-password) | `0.3.1` | `0.4.0` |
| [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.6.13` | `3.7.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.82.0` | `1.82.1` |



Updates `github.com/beevik/etree` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/beevik/etree/releases)
- [Changelog](https://github.com/beevik/etree/blob/main/RELEASE_NOTES.md)
- [Commits](beevik/etree@v1.6.0...v1.7.0)

Updates `github.com/coreos/go-oidc/v3` from 3.19.0 to 3.20.0
- [Release notes](https://github.com/coreos/go-oidc/releases)
- [Commits](coreos/go-oidc@v3.19.0...v3.20.0)

Updates `github.com/go-chi/chi/v5` from 5.3.0 to 5.3.1
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.3.0...v5.3.1)

Updates `github.com/go-ldap/ldap/v3` from 3.4.13 to 3.4.14
- [Release notes](https://github.com/go-ldap/ldap/releases)
- [Commits](go-ldap/ldap@v3.4.13...v3.4.14)

Updates `github.com/mattn/go-sqlite3` from 1.14.47 to 1.14.48
- [Release notes](https://github.com/mattn/go-sqlite3/releases)
- [Commits](mattn/go-sqlite3@v1.14.47...v1.14.48)

Updates `github.com/sethvargo/go-password` from 0.3.1 to 0.4.0
- [Release notes](https://github.com/sethvargo/go-password/releases)
- [Commits](sethvargo/go-password@v0.3.1...v0.4.0)

Updates `go.etcd.io/etcd/client/v3` from 3.6.13 to 3.7.0
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.6.13...v3.7.0)

Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
- [Commits](golang/crypto@v0.53.0...v0.54.0)

Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](golang/sync@v0.21.0...v0.22.0)

Updates `golang.org/x/sys` from 0.46.0 to 0.47.0
- [Commits](golang/sys@v0.46.0...v0.47.0)

Updates `golang.org/x/term` from 0.44.0 to 0.45.0
- [Commits](golang/term@v0.44.0...v0.45.0)

Updates `golang.org/x/text` from 0.38.0 to 0.40.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.38.0...v0.40.0)

Updates `google.golang.org/grpc` from 1.82.0 to 1.82.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.82.0...v1.82.1)

---
updated-dependencies:
- dependency-name: github.com/beevik/etree
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/coreos/go-oidc/v3
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/go-ldap/ldap/v3
  dependency-version: 3.4.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/mattn/go-sqlite3
  dependency-version: 1.14.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/sethvargo/go-password
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.etcd.io/etcd/client/v3
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/sys
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/term
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/text
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 19, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 19, 2026 22:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 19, 2026
@kw-security

kw-security commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@DeepDiver1975

DeepDiver1975 commented Jul 20, 2026

Copy link
Copy Markdown
Member

Holding: CI is failing (not a rebase conflict). Failing checks: unit-tests + ci-ok. A rebase won't fix this — needs a human/upstream fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kw-security @DeepDiver1975