Bump the go-modules group across 1 directory with 12 updates by dependabot[bot] · Pull Request #1715 · paketo-buildpacks/node-engine

dependabot · 2026-09-29T16:56:51Z

Bumps the go-modules group with 12 updates in the / directory:

Package	From	To
github.com/ProtonMail/go-crypto	`1.4.1`	`1.5.1`
github.com/aws/aws-sdk-go-v2/service/s3	`1.113.1`	`1.113.2`
github.com/aws/smithy-go	`1.28.1`	`1.28.2`
github.com/bmatcuk/doublestar/v4	`4.10.0`	`4.10.2`
github.com/ebitengine/purego	`0.11.0`	`0.11.1`
github.com/googleapis/gax-go/v2	`2.24.1`	`2.25.0`
github.com/huandu/xstrings	`1.6.0`	`1.6.1`
github.com/spiffe/go-spiffe/v2	`2.8.1`	`2.8.2`
github.com/ulikunitz/xz	`0.5.16`	`0.5.17`
google.golang.org/api	`0.298.0`	`0.299.0`
google.golang.org/genproto/googleapis/rpc	`0.0.0-20260825221802-da73d73af1c5`	`0.0.0-20260921155816-b14227669459`
modernc.org/libc	`1.77.0`	`1.77.1`

Updates github.com/ProtonMail/go-crypto from 1.4.1 to 1.5.1

Release notes

Sourced from github.com/ProtonMail/go-crypto's releases.

Release v1.5.1

What's Changed

Harden handling of malformed OpenPGP input in ProtonMail/go-crypto#332

Ensure rsa key gen test works with go 1.27 in ProtonMail/go-crypto#334

Full Changelog: ProtonMail/go-crypto@v1.5.0...v1.5.1

Release v1.5.1-proton

This release is v1.5.1 with support for the following non-standardized features:

Presistent symmetric keys experimental + latest draft draft-ietf-openpgp-persistent-symmetric-keys-00

Automatic forwarding draft-wussler-openpgp-forwarding-00

Release v1.5.0

What's Changed

Implement ML-KEM, ML-DSA, and SLH-DSA in ProtonMail/go-crypto#316

Bump github.com/cloudflare/circl to 1.6.3 in ProtonMail/go-crypto#302

Ensure generated RSA key primes satisfy P < Q constraint in ProtonMail/go-crypto#305

Add Signature.IssuerKeyVersion field in ProtonMail/go-crypto#310

Fix RSA precompute after prime swap in ProtonMail/go-crypto#317

openpgp: prevent panic when candidate identity has no self-signature in ProtonMail/go-crypto#313

guard nil issuer key id when checking trailing signature in ProtonMail/go-crypto#320

guard nil issuer key id on v2 message read path in ProtonMail/go-crypto#319

Don't panic on unknown AEAD mode in v5/v6 SKESK packets in ProtonMail/go-crypto#322

restrict embedding to embeddable signature types in ProtonMail/go-crypto#325

fix: Malformed session key decoding in PKESK in ProtonMail/go-crypto#330

fix: Do not accept malformed ecdh sk input in ProtonMail/go-crypto#329

fix: Reduce risk of invalid slice access in ProtonMail/go-crypto#331

Full Changelog: ProtonMail/go-crypto@v1.4.1...v1.5.0

Commits

b3ee477 test: Ensure rsa key gen test works with go 1.27 (#334)
361d29a Harden handling of malformed OpenPGP input (#332)
9f896c8 fix: Reduce risk of invalid slice access (#331)
1252688 fix: Do not accept malformed ecdh input (#329)
ac21ec5 fix: PKESK empty message decryption (#330)
d697e70 Reject embedded signatures in primary key binding signatures (#325)
d1dc24f Don't panic on unknown AEAD mode in v5/v6 SKESK packets (#322)
f7bfe56 Guard against nil issuer key ID on v2 message read path (#319)
4fa2a8d Guard against nil issuer key ID when checking trailing signature (#320)
0c1128b Implement ML-KEM, ML-DSA, and SLH-DSA (#316)
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.1 to 1.113.2

Commits

b85a735 Release 2026-09-21
ceecc62 Regenerated Clients
48a4bd1 Update API model
901c19d Expand S3 operations that check for an error inside an HTTP 200 response (wav...
145ae38 schema-serde json 9/21 (#3562)
2a45d3f Release 2026-09-18
eb31d96 Regenerated Clients
55f9850 Update API model
98cb1cb Release 2026-09-17
f2bc6f7 Regenerated Clients
Additional commits viewable in compare view

Updates github.com/aws/smithy-go from 1.28.1 to 1.28.2

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-09-18)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.28.2

Bug Fix: Avoid allocating a slice in ValidateEndpointHost by indexing into the hostname instead of using strings.Split.

Bug Fix: Fix event stream decode panic on unknown header value type.

Bug Fix: Fix schema-serde CBOR decode panic on malformed string/blob length.

Bug Fix: JoinPath keeps a trailing slash when the added path is a slash.

Release (2026-08-26)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.28.1

Bug Fix: Fix broken AddLogger middleware since its insert point was removed.

Release (2026-08-25.2)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.28.0

Feature: Set Content-Length inline when the request body is set via SetStream. The ComputeContentLength middleware is now deprecated.

Release (2026-08-25)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.27.10

Bug Fix: Fix a data race on the underlying writer when an event stream is closed while an event write is in flight.

Bug Fix: Restore draining the HTTP response body in CloseResponseBody to avoid issues with TCP connection reuse.

Release (2026-08-21)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.27.9

Bug Fix: Fix a generic event stream exception not carrying the error code and message from its payload.

Bug Fix: Fix an event stream not being closed when its connection is lost, which would cause a caller writing to the stream to block indefinitely.

Bug Fix: Fix deserialization of an empty list producing a nil slice instead of an empty one.

... (truncated)

Commits

9b28af0 Release 2026-09-18
f59df88 Avoid slice allocation in ValidateEndpointHost (#705)
7c16d7f fix decode panic on event stream header type and bad cbor string/blob len (#713)
c60819a fix initial-message race (#712)
d05a672 fix v2 event streams orphaning the result channel on error paths in schema-se...
fe95176 Revert "fix v2 event streams orphaning the result channel on error paths in s...
9847245 fix v2 event streams orphaning the result channel on error paths in schema-serde
9eba49f Print stacktrace when smithy-build fails (#708)
959c6ab Keep a trailing slash when JoinPath right operand is a slash. (#698)
d253285 update README
See full diff in compare view

Updates github.com/bmatcuk/doublestar/v4 from 4.10.0 to 4.10.2

Release notes

Sourced from github.com/bmatcuk/doublestar/v4's releases.

Better support for Windows "Junctions"

Has improved support for reading "junctions" in Windows (ie, Windows' version of symlinks).

Thanks @x0Lazarus for the PR!

What's Changed

Fix Windows junction traversal with Go 1.23 and later by @x0Lazarus in bmatcuk/doublestar#117

New Contributors

@x0Lazarus made their first contribution in bmatcuk/doublestar#117

Full Changelog: bmatcuk/doublestar@v4.10.1...v4.10.2

Fixed issue with alternatives and character classes

There was an issue where commas or ending curly brackets inside a character class would cause code looking for the next alternative (commas) or the end of alternatives (ending curly brackets) to erroneously match those characters inside the character classes.

Thanks to @sidsri14 for the fix!

What's Changed

fix brace alternation scanning with character classes by @sidsri14 in bmatcuk/doublestar#115

New Contributors

@sidsri14 made their first contribution in bmatcuk/doublestar#115

Full Changelog: bmatcuk/doublestar@v4.10.0...v4.10.1

Commits

fc7b711 update CI
7b00623 Merge branch 'x0Lazarus-fix/windows-junction-traversal'
146da9c small test changes
dbb13b8 fix brace alternation scanning with character classes
314a609 Merge branch 'sidsri14-master'
f0902d5 small test changes
ee530d0 Fix traversal of Windows junctions reported as irregular files
bf0b1d6 fix brace alternation scanning with character classes
See full diff in compare view

Updates github.com/ebitengine/purego from 0.11.0 to 0.11.1

Release notes

Sourced from github.com/ebitengine/purego's releases.

v0.11.1

Fix SyscallN returning the third input argument as an error code on platforms that do not capture errno; it now returns 0 (#505)

Fix 64-bit integer callback return values losing their upper 32 bits on 386 (#524)

Commits

15800b5 purego: return 64-bit callback results on 386 (#519)
fc7e496 purego: clear uncaptured errno in syscall trampolines (#510)
See full diff in compare view

Updates github.com/googleapis/gax-go/v2 from 2.24.1 to 2.25.0

Release notes

Sourced from github.com/googleapis/gax-go/v2's releases.

v2.25.0

2.25.0 (2026-09-21)

Features

update go min version to 1.26 (#548) (b943a7d)

Commits

0c567ee chore(main): release 2.25.0 (#549)
b943a7d feat: update go min version to 1.26 (#548)
70cba90 chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 (#545)
2a1344f impl(o11y): implement client request spans in Invoke (#547)
6bcd109 impl(o11y): add startSpan helper for client request spans (#546)
4aa492c impl(o11y): add endSpan helper for client request spans (#543)
820c09c impl(o11y): add span name resolution for client request spans (#542)
0e86bbe impl(o11y): add WithClientTracing CallOption (#541)
00e2eb6 impl(o11y): add ClientTracing configuration (#540)
29d82d4 chore: migrate repo to use 1.27 as latest, 1.26 as earliest (#538)
Additional commits viewable in compare view

Updates github.com/huandu/xstrings from 1.6.0 to 1.6.1

Commits

f835cc2 Merge pull request #68 from x0Lazarus/docs-scrub-replacement-character
affb8e6 Merge pull request #69 from jakezwang/fix/camelcase-trailing-initial
cedef93 fix: preserve trailing uppercase initials in camel case
86af16d docs: clarify Scrub handling of replacement characters
See full diff in compare view

Updates github.com/spiffe/go-spiffe/v2 from 2.8.1 to 2.8.2

Release notes

Sourced from github.com/spiffe/go-spiffe/v2's releases.

v2.8.2

Fixed

Data race in workloadapi.X509Source and workloadapi.JWTSource when reading bundles while the Workload API watcher updates them (#420)

Changelog

Sourced from github.com/spiffe/go-spiffe/v2's changelog.

[2.8.2] - 2026-09-18

Fixed

Data race in workloadapi.X509Source and workloadapi.JWTSource when reading bundles while the Workload API watcher updates them (#420)

Commits

2ae1759 v2.8.2 changelog (#421)
2b6d4ba Bump actions/setup-go from 6 to 7 (#403)
30be436 Bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (#416)
c43c434 Fix race condition when accessing bundle (#420)
9819590 Bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5 (#419)
cb388d8 Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#414)
See full diff in compare view

Updates github.com/ulikunitz/xz from 0.5.16 to 0.5.17

Commits

6ead826 Prepare release v0.5.17
f5969eb Merge pull request #81 from clydeeshun94/master
591e09e fix: retry (0, nil) reads in breader.ReadByte
See full diff in compare view

Updates google.golang.org/api from 0.298.0 to 0.299.0

Release notes

Sourced from google.golang.org/api's releases.

v0.299.0

0.299.0 (2026-09-21)

Features

all: Auto-regenerate discovery clients (#3734) (05c5fb0)

all: Auto-regenerate discovery clients (#3737) (3b54280)

all: Auto-regenerate discovery clients (#3738) (7089c40)

Changelog

Sourced from google.golang.org/api's changelog.

0.299.0 (2026-09-21)

Features

all: Auto-regenerate discovery clients (#3734) (05c5fb0)

all: Auto-regenerate discovery clients (#3737) (3b54280)

all: Auto-regenerate discovery clients (#3738) (7089c40)

Commits

38da4c8 chore(main): release 0.299.0 (#3735)
87958bd chore(all): update all (#3740)
7089c40 feat(all): auto-regenerate discovery clients (#3738)
3b54280 feat(all): auto-regenerate discovery clients (#3737)
adf75d8 chore(all): update all (#3721)
62460e9 chore: upgrade repo to use 1.27 latest, 1.26 earliest (#3736)
05c5fb0 feat(all): auto-regenerate discovery clients (#3734)
237a7dd testing: refine vet checks (#3733)
See full diff in compare view

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20260825221802-da73d73af1c5 to 0.0.0-20260921155816-b14227669459

Commits

See full diff in compare view

Updates modernc.org/libc from 1.77.0 to 1.77.1

Commits

9176651 modernc.org/libc: s390x auto generate
1224587 modernc.org/libc: riscv64 auto generate
5606341 modernc.org/libc: linux_loong64b auto generate
7755638 modernc.org/libc: pi32 auto generate
459b29d modernc.org/libc: ppc64le auto generate
7c99fc9 modernc.org/libc: e5-1650 auto generate
d6a4fd1 modernc.org/libc: pi64 auto generate
61f8432 modernc.org/libc: nuc64 auto generate
ba4fd52 nuc64: auto deps
8372797 for f in internal/autogen/*.mod ; do echo > $f ; done
Additional commits viewable in compare view

Bumps the go-modules group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/ProtonMail/go-crypto](https://github.com/ProtonMail/go-crypto) | `1.4.1` | `1.5.1` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.113.1` | `1.113.2` | | [github.com/aws/smithy-go](https://github.com/aws/smithy-go) | `1.28.1` | `1.28.2` | | [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) | `4.10.0` | `4.10.2` | | [github.com/ebitengine/purego](https://github.com/ebitengine/purego) | `0.11.0` | `0.11.1` | | [github.com/googleapis/gax-go/v2](https://github.com/googleapis/gax-go) | `2.24.1` | `2.25.0` | | [github.com/huandu/xstrings](https://github.com/huandu/xstrings) | `1.6.0` | `1.6.1` | | [github.com/spiffe/go-spiffe/v2](https://github.com/spiffe/go-spiffe) | `2.8.1` | `2.8.2` | | [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) | `0.5.16` | `0.5.17` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.298.0` | `0.299.0` | | [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20260825221802-da73d73af1c5` | `0.0.0-20260921155816-b14227669459` | | [modernc.org/libc](https://gitlab.com/cznic/libc) | `1.77.0` | `1.77.1` | Updates `github.com/ProtonMail/go-crypto` from 1.4.1 to 1.5.1 - [Release notes](https://github.com/ProtonMail/go-crypto/releases) - [Commits](ProtonMail/go-crypto@v1.4.1...v1.5.1) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.113.1 to 1.113.2 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.113.1...service/s3/v1.113.2) Updates `github.com/aws/smithy-go` from 1.28.1 to 1.28.2 - [Release notes](https://github.com/aws/smithy-go/releases) - [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md) - [Commits](aws/smithy-go@v1.28.1...v1.28.2) Updates `github.com/bmatcuk/doublestar/v4` from 4.10.0 to 4.10.2 - [Release notes](https://github.com/bmatcuk/doublestar/releases) - [Commits](bmatcuk/doublestar@v4.10.0...v4.10.2) Updates `github.com/ebitengine/purego` from 0.11.0 to 0.11.1 - [Release notes](https://github.com/ebitengine/purego/releases) - [Commits](ebitengine/purego@v0.11.0...v0.11.1) Updates `github.com/googleapis/gax-go/v2` from 2.24.1 to 2.25.0 - [Release notes](https://github.com/googleapis/gax-go/releases) - [Commits](googleapis/gax-go@v2.24.1...v2.25.0) Updates `github.com/huandu/xstrings` from 1.6.0 to 1.6.1 - [Release notes](https://github.com/huandu/xstrings/releases) - [Commits](huandu/xstrings@v1.6.0...v1.6.1) Updates `github.com/spiffe/go-spiffe/v2` from 2.8.1 to 2.8.2 - [Release notes](https://github.com/spiffe/go-spiffe/releases) - [Changelog](https://github.com/spiffe/go-spiffe/blob/main/CHANGELOG.md) - [Commits](spiffe/go-spiffe@v2.8.1...v2.8.2) Updates `github.com/ulikunitz/xz` from 0.5.16 to 0.5.17 - [Commits](ulikunitz/xz@v0.5.16...v0.5.17) Updates `google.golang.org/api` from 0.298.0 to 0.299.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.298.0...v0.299.0) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260825221802-da73d73af1c5 to 0.0.0-20260921155816-b14227669459 - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `modernc.org/libc` from 1.77.0 to 1.77.1 - [Commits](https://gitlab.com/cznic/libc/compare/v1.77.0...v1.77.1) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.113.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/aws/smithy-go dependency-version: 1.28.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/bmatcuk/doublestar/v4 dependency-version: 4.10.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/ebitengine/purego dependency-version: 0.11.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/googleapis/gax-go/v2 dependency-version: 2.25.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/huandu/xstrings dependency-version: 1.6.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/ProtonMail/go-crypto dependency-version: 1.5.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/spiffe/go-spiffe/v2 dependency-version: 2.8.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/ulikunitz/xz dependency-version: 0.5.17 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: google.golang.org/api dependency-version: 0.299.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260921155816-b14227669459 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: modernc.org/libc dependency-version: 1.77.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-01T16:55:05Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 29, 2026

dependabot Bot requested review from a team as code owners September 29, 2026 16:56

dependabot Bot added the go Pull requests that update Go code label Sep 29, 2026

dependabot Bot requested review from pacostas and removed request for a team September 29, 2026 16:56

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 29, 2026

dependabot Bot requested a review from paketo-bot-reviewer September 29, 2026 16:56

paketo-bot added the semver:patch A change requiring a patch version bump label Sep 29, 2026

paketo-bot-reviewer previously approved these changes Sep 29, 2026

View reviewed changes

paketo-bot-reviewer enabled auto-merge (rebase) September 29, 2026 17:08

dependabot Bot dismissed paketo-bot-reviewer’s stale review via cbd3a06 September 30, 2026 16:56

dependabot Bot force-pushed the dependabot/go_modules/go-modules-63996f9b57 branch from 2bc13ff to cbd3a06 Compare September 30, 2026 16:56

paketo-bot-reviewer approved these changes Sep 30, 2026

View reviewed changes

dependabot Bot closed this Oct 1, 2026

auto-merge was automatically disabled October 1, 2026 16:55
Pull request was closed

dependabot Bot deleted the dependabot/go_modules/go-modules-63996f9b57 branch October 1, 2026 16:55

Navigation Menu

Repository navigation

Bump the go-modules group across 1 directory with 12 updates - #1715

Bump the go-modules group across 1 directory with 12 updates#1715
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-63996f9b57

dependabot Bot commented on behalf of github Sep 29, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release v1.5.1

What's Changed

Release v1.5.1-proton

Release v1.5.0

What's Changed

Release (2026-09-18)

General Highlights

Module Highlights

Release (2026-08-26)

General Highlights

Module Highlights

Release (2026-08-25.2)

General Highlights

Module Highlights

Release (2026-08-25)

General Highlights

Module Highlights

Release (2026-08-21)

General Highlights

Module Highlights

Better support for Windows "Junctions"

What's Changed

New Contributors

Fixed issue with alternatives and character classes

What's Changed

New Contributors

v0.11.1

v2.25.0

2.25.0 (2026-09-21)

Features

v2.8.2

Fixed

[2.8.2] - 2026-09-18

Fixed

v0.299.0

0.299.0 (2026-09-21)

Features

0.299.0 (2026-09-21)

Features

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Sep 29, 2026 •

edited

Loading