Skip to content

Bump the all-go-deps group across 1 directory with 7 updates#409

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/all-go-deps-6eed3b4202
Closed

Bump the all-go-deps group across 1 directory with 7 updates#409
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/all-go-deps-6eed3b4202

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026 •
edited
Loading

Bumps the all-go-deps group with 6 updates in the / directory:

Package From To
cloud.google.com/go/storage 1.42.0 1.62.1
github.com/lib/pq 1.10.9 1.12.3
github.com/sirupsen/logrus 1.9.3 1.9.4
github.com/spf13/cobra 1.7.0 1.10.2
github.com/spf13/viper 1.17.0 1.21.0
github.com/stellar/go-stellar-sdk 0.0.0-20260325174035-031e5bfdc4bd 0.5.0

Updates cloud.google.com/go/storage from 1.42.0 to 1.62.1

Release notes

Sourced from cloud.google.com/go/storage's releases.

storage: v1.62.1

v1.62.1 (2026-04-13)

Changelog

Sourced from cloud.google.com/go/storage's changelog.

Changes

1.46.0 (2026-04-13)

1.45.0 (2026-04-09)

1.44.0 (2026-04-02)

1.43.0 (2026-03-23)

Features

  • Add a field for upgrading previous processor version when fine tuning (790bab5)
Commits
  • f4b10ee chore: librarian release pull request: 20260413T041034Z (#14421)
  • dc245af feat(storage): add client feature tracking support (#14320)
  • cfdd7ba chore(.github/CODEOWNERS): Add AION SDK as code owners for the auth library (...
  • e2d578c test(datastore): skip flaky tests due to datastore contention (#14416)
  • 56e1a62 chore: librarian release pull request: 20260409T222456Z (#14413)
  • 5ca653a chore: regenerate libraries using protobuf 31, and update generation check wo...
  • b4c40aa chore(all): update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY] ...
  • eb896d0 chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 in /comp...
  • 26c0341 chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 in /cont...
  • 8a7febc feat(firestore): Implement Search pipeline stage and related expressions (#14...
  • Additional commits viewable in compare view

Updates github.com/lib/pq from 1.10.9 to 1.12.3

Release notes

Sourced from github.com/lib/pq's releases.

v1.12.3

  • Send datestyle startup parameter, improving compatbility with database engines that use a different default datestyle such as EnterpriseDB (#1312).

#1312: lib/pq#1312

v1.12.2

  • Treat io.ErrUnexpectedEOF as driver.ErrBadConn so database/sql discards the connection. Since v1.12.0 this could result in permanently broken connections, especially with CockroachDB which frequently sends partial messages (#1299).

#1299: lib/pq#1299

v1.12.1

  • Look for pgpass file in ~/.pgpass instead of ~/.postgresql/pgpass (#1300).

  • Don't clear password if directly set on pq.Config (#1302).

#1300: lib/pq#1300 #1302: lib/pq#1302

v1.12.0

  • The next release may change the default sslmode from require to prefer. See #1271 for details.

  • CopyIn() and CopyInToSchema() have been marked as deprecated. These are simple query builders and not needed for COPY [..] FROM STDIN support (which is not deprecated). (#1279)

    // Old
tx.Prepare(CopyIn("temp", "num", "text", "blob", "nothing"))

    // Replacement
tx.Prepare(copy temp (num, text, blob, nothing) from stdin)

Features

  • Support protocol 3.2, and the min_protocol_version and max_protocol_version DSN parameters (#1258).

  • Support sslmode=prefer and sslmode=allow (#1270).

  • Support ssl_min_protocol_version and ssl_max_protocol_version (#1277).

  • Support connection service file to load connection details (#1285).

  • Support sslrootcert=system and use ~/.postgresql/root.crt as the default value of sslrootcert (#1280, #1281).

  • Add a new pqerror package with PostgreSQL error codes (#1275).

    For example, to test if an error is a UNIQUE constraint violation:

    if pqErr, ok := errors.AsType[*pq.Error](https://github.com/lib/pq/blob/HEAD/err); ok && pqErr.Code == pqerror.UniqueViolation {
    log.Fatalf("email %q already exsts", email)
}

    To make this a bit more convenient, it also adds a pq.As() function:

... (truncated)

Changelog

Sourced from github.com/lib/pq's changelog.

v1.12.3 (2026-04-03)

  • Send datestyle startup parameter, improving compatbility with database engines that use a different default datestyle such as EnterpriseDB (#1312).

#1312: lib/pq#1312

v1.12.2 (2026-04-02)

  • Treat io.ErrUnexpectedEOF as driver.ErrBadConn so database/sql discards the connection. Since v1.12.0 this could result in permanently broken connections, especially with CockroachDB which frequently sends partial messages (#1299).

#1299: lib/pq#1299

v1.12.1 (2026-03-30)

  • Look for pgpass file in ~/.pgpass instead of ~/.postgresql/pgpass (#1300).

  • Don't clear password if directly set on pq.Config (#1302).

#1300: lib/pq#1300 #1302: lib/pq#1302

v1.12.0 (2026-03-18)

  • The next release may change the default sslmode from require to prefer. See #1271 for details.

  • CopyIn() and CopyInToSchema() have been marked as deprecated. These are simple query builders and not needed for COPY [..] FROM STDIN support (which is not deprecated). (#1279)

    // Old
tx.Prepare(CopyIn("temp", "num", "text", "blob", "nothing"))

    // Replacement
tx.Prepare(copy temp (num, text, blob, nothing) from stdin)

Features

  • Support protocol 3.2, and the min_protocol_version and max_protocol_version DSN parameters (#1258).

  • Support sslmode=prefer and sslmode=allow (#1270).

  • Support ssl_min_protocol_version and ssl_max_protocol_version (#1277).

... (truncated)

Commits
  • 1f3e3d9 Send datestyle as a startup parameter (#1312)
  • 32ba56b Expand tests for multiple result sets
  • c2cfac1 Release v1.12.2
  • 859f104 Test CockroachDB
  • 12e464c Allow multiple matches and regexps in pqtest.ErrorContains()
  • 6d77ced Treat io.ErrUnexpectedEOF as driver.ErrBadConn in handleError
  • 71daecb Ensure transactions are closed in pqtest
  • 8f44823 Set PGAPPNAME for tests
  • 4af2196 Fix healthcheck
  • 38a54e4 Split out testdata/init a bit
  • Additional commits viewable in compare view

Updates github.com/sirupsen/logrus from 1.9.3 to 1.9.4

Release notes

Sourced from github.com/sirupsen/logrus's releases.

v1.9.4

Notable changes

Full Changelog: sirupsen/logrus@v1.9.3...v1.9.4

Changelog

Sourced from github.com/sirupsen/logrus's changelog.

1.9.4

Fixes:

  • Remove uses of deprecated ioutil package

Features:

  • Add GNU/Hurd support
  • Add WASI wasip1 support

Code quality:

  • Update minimum supported Go version to 1.17
  • Documentation updates
Commits
  • b61f268 Merge pull request #1472 from goldlinker/master
  • 15c29db refactor: replace the deprecated function in the ioutil package
  • cb253f3 Merge pull request #1464 from thaJeztah/touchup_godoc
  • 29b2337 Merge pull request #1468 from thaJeztah/touchup_readme
  • d916819 Merge pull request #1427 from dolmen/fix-testify-usage
  • 135e482 README: small touch-ups
  • 2c5fa36 Merge pull request #1467 from thaJeztah/rm_old_badge
  • 877ecec README: remove travis badge
  • 55cf256 Merge pull request #1393 from jsoref/grammar
  • 21bae50 Merge pull request #1426 from dolmen/testing-fix-use-of-math-rand
  • Additional commits viewable in compare view

Updates github.com/spf13/cobra from 1.7.0 to 1.10.2

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.10.2

🔧 Dependencies

  • chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @​dims in spf13/cobra#2336 - the gopkg.in/yaml.v3 package has been deprecated for some time: this should significantly cleanup dependency/supply-chains for consumers of spf13/cobra

📈 CI/CD

🔥✍🏼 Docs

🍂 Refactors

🤗 New Contributors

Full Changelog: spf13/cobra@v1.10.1...v1.10.2

Thank you to our amazing contributors!!!!! 🐍 🚀

v1.10.1

🐛 Fix

v1.0.9 of pflags brought back ParseErrorsWhitelist and marked it as deprecated

Full Changelog: spf13/cobra@v1.10.0...v1.10.1

v1.10.0

What's Changed

🚨 Attention!

This version of pflag carried a breaking change: it renamed ParseErrorsWhitelist to ParseErrorsAllowlist which can break builds if both pflag and cobra are dependencies in your project.

  • If you use both pflag and cobra, upgrade pflagto 1.0.8 andcobrato1.10.0`
  • or use the newer, fixed version of pflag v1.0.9 which keeps the deprecated ParseErrorsWhitelist

... (truncated)

Commits

Updates github.com/spf13/pflag from 1.0.5 to 1.0.9

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.9

What's Changed

Full Changelog: spf13/pflag@v1.0.8...v1.0.9

v1.0.8

⚠️ Breaking Change

This version, while only a patch bump, includes a (very minor) breaking change: the flag.ParseErrorsWhitelist struct and corresponding FlagSet.parseErrorsWhitelist field have been renamed to ParseErrorsAllowlist.

This should result in compilation errors in any code that uses these fields, which can be fixed by adjusting the names at call sites. There is no change in semantics or behavior of the struct or field referred to by these names. If your code compiles without errors after bumping to/past v1.0.8, you are not affected by this change.

The breaking change was reverted in v1.0.9, by means of re-introducing the old names with deprecation warnings. The plan is still to remove them in a future release, so if your code does depend on the old names, please change them to use the new names at your earliest convenience.

What's Changed

New Contributors

Full Changelog: spf13/pflag@v1.0.7...v1.0.8

v1.0.7

What's Changed

New Contributors

... (truncated)

Commits
  • 1043857 Merge pull request #446 from spf13/fix-backwards-compat
  • 7412009 fix: Restore ParseErrorsWhitelist name for now
  • b9c16fa Merge pull request #444 from spf13/reset-args-even-if-empty
  • 40abc49 Merge pull request #443 from spf13/silence-errhelp
  • 1bf832c Use errors.Is instead of equality check
  • d25dd24 Reset args on re-parse even if empty
  • 094909d Merge pull request #365 from vaguecoder/str2str-sorted
  • ccb49e5 Print Default Values of String-to-String in Sorted Order
  • b55ffb6 fix: Don't print ErrHelp in ParseAll
  • 7c651d1 Merge pull request #407 from tmc/fix-errhelp
  • Additional commits viewable in compare view

Updates github.com/spf13/viper from 1.17.0 to 1.21.0

Release notes

Sourced from github.com/spf13/viper's releases.

v1.21.0

What's Changed

Enhancements 🚀

Bug Fixes 🐛

Dependency Updates ⬆️

Other Changes

New Contributors

Full Changelog: spf13/viper@v1.20.0...v1.21.0

v1.20.1

What's Changed

Bug Fixes 🐛

Full Changelog: spf13/viper@v1.20.0...v1.20.1

v1.20.0

... (truncated)

Commits
  • 394040c ci: build on go 1.25
  • 812f548 chore: update dependencies
  • d5271ef ci: update stale workflow
  • dff303b feat: add a stale issue scheduled action
  • 1287976 build(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10
  • 38932cd build(deps): bump github.com/go-viper/mapstructure/v2 in /remote
  • 6d014be build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1
  • b74c7ee build(deps): bump github.com/fsnotify/fsnotify from 1.8.0 to 1.9.0
  • acd05e1 fix: linting issues
  • ae5a8e2 ci: upgrade golangci-lint
  • Additional commits viewable in compare view

Updates github.com/stellar/go-stellar-sdk from 0.0.0-20260325174035-031e5bfdc4bd to 0.5.0

Release notes

Sourced from github.com/stellar/go-stellar-sdk's releases.

v0.5.0

What's Changed

Full Changelog: stellar/go-stellar-sdk@v0.4.0...v0.5.0

v0.4.0

Add Support for Protocol 26

What's Changed

Full Changelog: stellar/go-stellar-sdk@v0.3.0...v0.4.0

v0.3.0

What's Changed

Full Changelog: stellar/go-stellar-sdk@v0.2.0...v0.3.0

v0.2.0

Breaking Changes

  • Replaced SetExpectedHash/Close hash validation pattern with explicit ValidateHash method; Close now only releases resources. Added SetMaxRecordSize to configure per-record allocation limit (default 64MB) (#5900)

Security Fixes

  • Fixed InputLen() guard bypass in streaming XDR decoders (#5905)
  • strkey: Fixed panic on invalid payload length in DecodeSignedPayload (#5909)
  • keypair: Fixed panic on invalid payload length in ParseAddress (#5908)

New Features

  • rpcclient: Added PollTransaction with exponential backoff (#5876)
  • support/datastore: Added filesystem datastore support (#5892)

Full Changelog: stellar/go-stellar-sdk@v0.1.0...v0.2.0

v0.1.0

v0.1.0

Inaugural release of restructured SDK. This is first release of the newly restructured GO SDK. It is a single Go module providing multiple platform SDK's and utility packages such as:

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Apr 13, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 13, 2026 18:40
@dependabot dependabot Bot requested review from Copilot and removed request for Copilot April 13, 2026 18:40
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 13, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgithub.com/​stellar/​go-stellar-sdk@​v0.0.0-20260325174035-031e5bfdc4bd ⏵ v0.5.075 +1100100100100
Updatedcloud.google.com/​go/​storage@​v1.42.0 ⏵ v1.62.179 -5100100100100
Updatedgithub.com/​lib/​pq@​v1.10.9 ⏵ v1.12.393100100100100
Updatedgithub.com/​spf13/​cobra@​v1.7.0 ⏵ v1.10.295 -1100100100100
Updatedgithub.com/​spf13/​pflag@​v1.0.5 ⏵ v1.0.1097100100100100
Updatedgithub.com/​sirupsen/​logrus@​v1.9.3 ⏵ v1.9.498 +1100100100100
Updatedgithub.com/​spf13/​viper@​v1.17.0 ⏵ v1.21.099 +2100100100100

View full report

@dependabot
Bump the all-go-deps group across 1 directory with 7 updates
5619957 
Bumps the all-go-deps group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) | `1.42.0` | `1.62.1` |
| [github.com/lib/pq](https://github.com/lib/pq) | `1.10.9` | `1.12.3` |
| [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) | `1.9.3` | `1.9.4` |
| [github.com/spf13/cobra](https://github.com/spf13/cobra) | `1.7.0` | `1.10.2` |
| [github.com/spf13/viper](https://github.com/spf13/viper) | `1.17.0` | `1.21.0` |
| [github.com/stellar/go-stellar-sdk](https://github.com/stellar/go-stellar-sdk) | `0.0.0-20260325174035-031e5bfdc4bd` | `0.5.0` |



Updates `cloud.google.com/go/storage` from 1.42.0 to 1.62.1
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](googleapis/google-cloud-go@pubsub/v1.42.0...storage/v1.62.1)

Updates `github.com/lib/pq` from 1.10.9 to 1.12.3
- [Release notes](https://github.com/lib/pq/releases)
- [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md)
- [Commits](lib/pq@v1.10.9...v1.12.3)

Updates `github.com/sirupsen/logrus` from 1.9.3 to 1.9.4
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](sirupsen/logrus@v1.9.3...v1.9.4)

Updates `github.com/spf13/cobra` from 1.7.0 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.7.0...v1.10.2)

Updates `github.com/spf13/pflag` from 1.0.5 to 1.0.9
- [Release notes](https://github.com/spf13/pflag/releases)
- [Commits](spf13/pflag@v1.0.5...v1.0.9)

Updates `github.com/spf13/viper` from 1.17.0 to 1.21.0
- [Release notes](https://github.com/spf13/viper/releases)
- [Commits](spf13/viper@v1.17.0...v1.21.0)

Updates `github.com/stellar/go-stellar-sdk` from 0.0.0-20260325174035-031e5bfdc4bd to 0.5.0
- [Release notes](https://github.com/stellar/go-stellar-sdk/releases)
- [Changelog](https://github.com/stellar/go-stellar-sdk/blob/main/CHANGELOG.md)
- [Commits](https://github.com/stellar/go-stellar-sdk/commits/v0.5.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/storage
  dependency-version: 1.62.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: github.com/lib/pq
  dependency-version: 1.12.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-deps
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: github.com/spf13/pflag
  dependency-version: 1.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-deps
- dependency-name: github.com/spf13/viper
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: github.com/stellar/go-stellar-sdk
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the all-go-deps group with 7 updates Bump the all-go-deps group across 1 directory with 7 updates Apr 28, 2026
Copilot AI review requested due to automatic review settings April 28, 2026 20:20
@dependabot dependabot Bot force-pushed the dependabot/go_modules/all-go-deps-6eed3b4202 branch from f2a19f8 to 5619957 Compare April 28, 2026 20:20
@dependabot dependabot Bot review requested due to automatic review settings April 28, 2026 20:20
@amishas157 amishas157 mentioned this pull request Apr 30, 2026
Merged
4 tasks
amishas157 added a commit that referenced this pull request Apr 30, 2026
@amishas157
Combine non-major Go dependency bumps from open Dependabot PRs (#417)
4c1e8d4 
Consolidates the open dependency bumps so reviewers don't have to chase
near-identical Dependabot PRs. No major upgrades.

Applied:
- cloud.google.com/go/storage 1.42.0 -> 1.62.1
- github.com/lib/pq 1.10.9 -> 1.12.3
- github.com/sirupsen/logrus 1.9.3 -> 1.9.4
- github.com/spf13/cobra 1.7.0 -> 1.10.2
- github.com/spf13/viper 1.17.0 -> 1.21.0
- github.com/stellar/go-stellar-sdk pseudo -> 0.5.0
- go.opentelemetry.io/otel 1.39.0 -> 1.43.0 (PR #415 was 1.41.0;
  bumped to 1.43.0 because cloud.google.com/go/storage 1.62.1 requires it)

Transitive bumps resolved by go mod tidy.

Supersedes #409 and #415.
@amishas157 amishas157 closed this Apr 30, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 30, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot Bot deleted the dependabot/go_modules/all-go-deps-6eed3b4202 branch April 30, 2026 18:42
amishas157 added a commit that referenced this pull request May 5, 2026
@amishas157
Combine non-major Go dependency bumps from open Dependabot PRs (#417)
560e93b 
Consolidates the open dependency bumps so reviewers don't have to chase
near-identical Dependabot PRs. No major upgrades.

Applied:
- cloud.google.com/go/storage 1.42.0 -> 1.62.1
- github.com/lib/pq 1.10.9 -> 1.12.3
- github.com/sirupsen/logrus 1.9.3 -> 1.9.4
- github.com/spf13/cobra 1.7.0 -> 1.10.2
- github.com/spf13/viper 1.17.0 -> 1.21.0
- github.com/stellar/go-stellar-sdk pseudo -> 0.5.0
- go.opentelemetry.io/otel 1.39.0 -> 1.43.0 (PR #415 was 1.41.0;
  bumped to 1.43.0 because cloud.google.com/go/storage 1.62.1 requires it)

Transitive bumps resolved by go mod tidy.

Supersedes #409 and #415.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@amishas157