Skip to content

chore(deps): bump the go_modules group across 1 directory with 16 updates - #2

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/go_modules/go_modules-3372c04dd7
Open

chore(deps): bump the go_modules group across 1 directory with 16 updates#2
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/go_modules/go_modules-3372c04dd7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 2, 2026

Copy link
Copy Markdown

Bumps the go_modules group with 12 updates in the / directory:

Package From To
golang.org/x/oauth2 0.22.0 0.27.0
github.com/getkin/kin-openapi 0.126.0 0.131.0
github.com/go-git/go-git/v5 5.13.0 5.19.1
github.com/Azure/go-ntlmssp 0.0.0-20221128193559-754e69321358 0.1.1
github.com/buger/jsonparser 1.1.1 1.1.2
github.com/docker/cli 24.0.5+incompatible 29.2.0+incompatible
github.com/golang-jwt/jwt/v5 5.2.1 5.2.2
github.com/nwaples/rardecode/v2 2.0.1 2.2.0
github.com/opencontainers/runc 1.1.14 1.2.8
github.com/refraction-networking/utls 1.6.7 1.8.2
github.com/antchfx/xpath 1.2.4 1.3.6
github.com/ulikunitz/xz 0.5.12 0.5.14

Updates golang.org/x/oauth2 from 0.22.0 to 0.27.0

Commits
  • 681b4d8 jws: split token into fixed number of parts
  • 3f78298 all: upgrade go directive to at least 1.23.0 [generated]
  • 109dabf endpoints: add links/provider for Discord
  • ac571fa oauth2: fix docs for Config.DeviceAuth
  • 314ee5b endpoints: add patreon endpoint
  • b9c813b google: add warning about externally-provided credentials
  • 49a531d all: make method and struct comments match the names
  • 22134a4 README: don't recommend go get
  • 3e64809 x/oauth2: add Token.ExpiresIn
  • 16a9973 jwt: rename example to avoid vet error
  • Additional commits viewable in compare view

Updates github.com/getkin/kin-openapi from 0.126.0 to 0.131.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.131.0

What's Changed

Full Changelog: getkin/kin-openapi@v0.130.0...v0.131.0

v0.130.0

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.129.0...v0.130.0

v0.129.0

What's Changed

New Contributors

... (truncated)

Commits
  • 67f0b23 openapi3filter: de-register ZipFileBodyDecoder and make a few decoders public...
  • 6da871e openapi3filter: apply default values of an array in a query param with explod...
  • a34baf0 openapi3: delete origin keys only when IncludeOrigin=true (#1055)
  • 2d3e67a use origin to minimize collisions (#1057)
  • e3d68dc Remove redundant ExcludeResponseBody check in ValidateResponse (#1056)
  • 050a930 openapi3gen: Fix issue with separate component generated for time.Time (#1052)
  • 72fb819 feat(openapi3gen): Customize json.RawMessage (#1050)
  • cea0a13 openapi2conv: convert references in nested additionalProperties schemas (#1047)
  • f476f7b openapi3filter: validation of x-www-form-urlencoded with arbitrary nested a...
  • 325cecc openapi3filter: simplify ValidateRequest implementation (#1041)
  • Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.13.0 to 5.19.1

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.1

What's Changed

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

v5.19.0

What's Changed

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

v5.18.0

What's Changed

Full Changelog: go-git/go-git@v5.17.2...v5.18.0

v5.17.2

What's Changed

⚠️ This release fixes a bug (go-git/go-git#1942) that blocked some users from upgrading to v5.17.1. Thanks @​pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

v5.17.1

What's Changed

... (truncated)

Commits
  • 3c3be60 Merge pull request #2137 from go-git/validate-v5
  • 3fba897 plumbing: format/packfile, cap delta chain depth in parser
  • a97d660 Merge pull request #2125 from hiddeco/v5/format-input-bounds
  • aeaa125 plumbing: format/objfile, require Header before Read
  • 1f38e17 plumbing: format/packfile, bound inflate size
  • f7545a0 plumbing: format/idxfile, bound nr by file size
  • 170b881 Merge pull request #2116 from pjbgf/symlink-v5
  • 7b6d994 Merge pull request #2117 from hiddeco/v5/worktree-fs-mkdirall-root-noop
  • f0709b3 git: Stop validating symlink target paths
  • 776d00f git: Allow MkdirAll on worktree-root paths
  • Additional commits viewable in compare view

Updates github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1

Release notes

Sourced from github.com/Azure/go-ntlmssp's releases.

v0.1.1

Fix CVE-2026-32952: A malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport.

v0.1.0

What's Changed

New Contributors

Full Changelog: Azure/go-ntlmssp@v0.0.1...v0.1.0

v0.0.1

What's Changed

... (truncated)

Commits

Updates github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.4.10 to 1.7.11

Commits

Updates github.com/buger/jsonparser from 1.1.1 to 1.1.2

Release notes

Sourced from github.com/buger/jsonparser's releases.

v1.1.2

What's Changed

New Contributors

Full Changelog: buger/jsonparser@v1.1.1...v1.1.2

Commits
  • a69e7e0 Merge pull request #276 from dbarrosop/master
  • d3eacc0 fix: prevent panic on negative slice index in Delete with malformed JSON (GO-...
  • 61b32cf Merge pull request #241 from unxcepted/master
  • 2181e83 Merge pull request #244 from ScaleChamp/patch-2
  • 1510b51 Added latest versions of go to tests
  • 6fc2e48 fix: eachkey allocation
  • a6f867e Merge pull request #239 from AdamKorcz/cifuzz1
  • cbc01fd Fuzzing: Add CIFuzz
  • dc92d69 Merge pull request #228 from jonomacd/null-handling
  • 2d9d634 Merge pull request #231 from carsonip/fix-parseint-overflow-check
  • Additional commits viewable in compare view

Updates github.com/cloudflare/circl from 1.3.8 to 1.6.3

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.6.3

Fix a bug on ecc/p384 scalar multiplication.

What's Changed

Full Changelog: cloudflare/circl@v1.6.2...v1.6.3

CIRCL v1.6.2

  • New SLH-DSA, improvements in ML-DSA for arm64.
  • Tested compilation on WASM.

What's Changed

New Contributors

Full Changelog: cloudflare/circl@v1.6.1...v1.6.2

CIRCL v1.6.1

  • Fixes some point checks on the FourQ curve.
  • Hybrid KEM fails on low-order points.

... (truncated)

Commits
  • 24ae53c Release CIRCL v1.6.3
  • 581020b Rename method to oddMultiplesProjective.
  • 12209a4 Removing unused cmov for jacobian points.
  • fcba359 ecc/p384: use of complete projective formulas for scalar multiplication.
  • 5e1bae8 ecc/p384: handle point doubling in point addition with Jacobian coordinates.
  • 3416046 Check opts for nil value.
  • a763d47 Release CIRCL v1.6.2
  • 3c70bf9 Bump x/crypto x/sys dependencies.
  • 3f0f15b Revert to using package-declared HPKE errors for shortkem instead of standard...
  • 23491bd Adding generic Power2Round method.
  • Additional commits viewable in compare view

Updates github.com/docker/cli from 24.0.5+incompatible to 29.2.0+incompatible

Commits
  • 0b9d198 Merge pull request #6764 from vvoland/update-docker
  • 9c9ec73 vendor: github.com/moby/moby/client v0.2.2
  • bab3e81 vendor: github.com/moby/moby/api v1.53.0
  • 2e64fc1 Merge pull request #6367 from thaJeztah/template_slicejoin
  • 1f2ba2a Merge pull request #6760 from thaJeztah/container_create_fix_error
  • e34a342 templates: make "join" work with non-string slices and map values
  • a86356d Merge pull request #6763 from thaJeztah/bump_mapstructure
  • 771660a vendor: github.com/go-viper/mapstructure/v2 v2.5.0
  • 9cff36b Merge pull request #6762 from thaJeztah/bump_x_deps
  • 08ed2bc cli/command/container: make injecting config.json failures a warning
  • Additional commits viewable in compare view

Updates github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2

Release notes

Sourced from github.com/golang-jwt/jwt/v5's releases.

v5.2.2

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.2.1...v5.2.2

Commits

Updates github.com/nwaples/rardecode/v2 from 2.0.1 to 2.2.0

Commits
  • 52fb4e8 allow max dictionary size to be set, with default now at 4GB
  • 9f4b0d1 dont let the dictionary be larger than the unpacked file size
  • 153fdf5 Merge pull request #47 from nwaples/bytereader
  • 3f140e5 document RarFS methods
  • b4fc922 change os.FileMode to fs.FileMode
  • edb01e7 add Seek support for uncompressed files
  • 710bda2 add initial Seek support for limitedReader
  • 9deacfb save offset in packetFileReader
  • 4f0a750 change limitedReader to save offset internally
  • 1c32663 split volume into readerVolume and fileVolume
  • Additional commits viewable in compare view

Updates github.com/opencontainers/runc from 1.1.14 to 1.2.8

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc v1.2.8 -- "鳥籠の中に囚われた屈辱を"

[!NOTE] Some vendors were given a pre-release version of this release. This public release includes two extra patches to fix regressions discovered very late during the embargo period and were thus not included in the pre-release versions. Please update to this version.

This release contains fixes for three high-severity security vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881). All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files.

Security

  • CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.

  • CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console. This issue affected all versions of runc >= 1.0.0-rc3.

  • CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.2.8] - 2025-11-05

鳥籠の中に囚われた屈辱を

Security

This release includes fixes for the following high-severity security issues:

  • CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.

  • CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console. This issue affected all versions of runc >= 1.0.0-rc3.

  • CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a ...

    Description has been truncated

@dependabot
chore(deps): bump the go_modules group across 1 directory with 16 upd…
2404d86 
…ates

Bumps the go_modules group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.22.0` | `0.27.0` |
| [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) | `0.126.0` | `0.131.0` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.13.0` | `5.19.1` |
| [github.com/Azure/go-ntlmssp](https://github.com/Azure/go-ntlmssp) | `0.0.0-20221128193559-754e69321358` | `0.1.1` |
| [github.com/buger/jsonparser](https://github.com/buger/jsonparser) | `1.1.1` | `1.1.2` |
| [github.com/docker/cli](https://github.com/docker/cli) | `24.0.5+incompatible` | `29.2.0+incompatible` |
| [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) | `5.2.1` | `5.2.2` |
| [github.com/nwaples/rardecode/v2](https://github.com/nwaples/rardecode) | `2.0.1` | `2.2.0` |
| [github.com/opencontainers/runc](https://github.com/opencontainers/runc) | `1.1.14` | `1.2.8` |
| [github.com/refraction-networking/utls](https://github.com/refraction-networking/utls) | `1.6.7` | `1.8.2` |
| [github.com/antchfx/xpath](https://github.com/antchfx/xpath) | `1.2.4` | `1.3.6` |
| [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) | `0.5.12` | `0.5.14` |



Updates `golang.org/x/oauth2` from 0.22.0 to 0.27.0
- [Commits](golang/oauth2@v0.22.0...v0.27.0)

Updates `github.com/getkin/kin-openapi` from 0.126.0 to 0.131.0
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](getkin/kin-openapi@v0.126.0...v0.131.0)

Updates `github.com/go-git/go-git/v5` from 5.13.0 to 5.19.1
- [Release notes](https://github.com/go-git/go-git/releases)
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)
- [Commits](go-git/go-git@v5.13.0...v5.19.1)

Updates `github.com/Azure/go-ntlmssp` from 0.0.0-20221128193559-754e69321358 to 0.1.1
- [Release notes](https://github.com/Azure/go-ntlmssp/releases)
- [Commits](https://github.com/Azure/go-ntlmssp/commits/v0.1.1)

Updates `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream` from 1.4.10 to 1.7.11
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/m2/v1.4.10...service/account/v1.7.11)

Updates `github.com/buger/jsonparser` from 1.1.1 to 1.1.2
- [Release notes](https://github.com/buger/jsonparser/releases)
- [Commits](buger/jsonparser@v1.1.1...v1.1.2)

Updates `github.com/cloudflare/circl` from 1.3.8 to 1.6.3
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](cloudflare/circl@v1.3.8...v1.6.3)

Updates `github.com/docker/cli` from 24.0.5+incompatible to 29.2.0+incompatible
- [Commits](docker/cli@v24.0.5...v29.2.0)

Updates `github.com/golang-jwt/jwt/v5` from 5.2.1 to 5.2.2
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Commits](golang-jwt/jwt@v5.2.1...v5.2.2)

Updates `github.com/nwaples/rardecode/v2` from 2.0.1 to 2.2.0
- [Commits](nwaples/rardecode@v2.0.1...v2.2.0)

Updates `github.com/opencontainers/runc` from 1.1.14 to 1.2.8
- [Release notes](https://github.com/opencontainers/runc/releases)
- [Changelog](https://github.com/opencontainers/runc/blob/main/CHANGELOG.md)
- [Commits](opencontainers/runc@v1.1.14...v1.2.8)

Updates `github.com/refraction-networking/utls` from 1.6.7 to 1.8.2
- [Release notes](https://github.com/refraction-networking/utls/releases)
- [Commits](refraction-networking/utls@v1.6.7...v1.8.2)

Updates `github.com/antchfx/xpath` from 1.2.4 to 1.3.6
- [Release notes](https://github.com/antchfx/xpath/releases)
- [Commits](antchfx/xpath@v1.2.4...v1.3.6)

Updates `github.com/ulikunitz/xz` from 0.5.12 to 0.5.14
- [Commits](ulikunitz/xz@v0.5.12...v0.5.14)

Updates `golang.org/x/crypto` from 0.37.0 to 0.50.0
- [Commits](golang/crypto@v0.37.0...v0.50.0)

Updates `github.com/go-git/go-billy/v5` from 5.6.0 to 5.9.0
- [Release notes](https://github.com/go-git/go-billy/releases)
- [Commits](go-git/go-billy@v5.6.0...v5.9.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.27.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.131.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.19.1
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/Azure/go-ntlmssp
  dependency-version: 0.1.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
  dependency-version: 1.7.11
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/buger/jsonparser
  dependency-version: 1.1.2
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/cloudflare/circl
  dependency-version: 1.6.3
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/docker/cli
  dependency-version: 29.2.0+incompatible
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/golang-jwt/jwt/v5
  dependency-version: 5.2.2
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/nwaples/rardecode/v2
  dependency-version: 2.2.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/opencontainers/runc
  dependency-version: 1.2.8
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/refraction-networking/utls
  dependency-version: 1.8.2
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/antchfx/xpath
  dependency-version: 1.3.6
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/ulikunitz/xz
  dependency-version: 0.5.14
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.50.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/go-git/go-billy/v5
  dependency-version: 5.9.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants