Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 9 updates - #314

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-2b243e10ca
Open

build(deps): bump the minor-and-patch group across 1 directory with 9 updates#314
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-2b243e10ca

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 8 updates in the / directory:

Package From To
github.com/brokenbots/criteria-go-adapter-sdk 0.5.2 0.5.3
github.com/sigstore/cosign/v3 3.1.2 3.1.3
github.com/sigstore/sigstore 1.10.8 1.10.9
github.com/sigstore/sigstore-go 1.2.2 1.3.0
github.com/stretchr/testify 1.11.1 1.12.1
github.com/testcontainers/testcontainers-go 0.43.0 0.44.0
golang.org/x/mod 0.38.0 0.40.0
google.golang.org/grpc 1.82.1 1.83.0

Updates github.com/brokenbots/criteria-go-adapter-sdk from 0.5.2 to 0.5.3

Release notes

Sourced from github.com/brokenbots/criteria-go-adapter-sdk's releases.

v0.5.3 — log-stream heartbeat survives an early Log return

Hardening

An adapter whose Log implementation returns early can no longer disable its own liveness heartbeat.

Previously the heartbeat ticker was scoped to the lifetime of the adapter's Log call (defer cancel()), so the natural "nothing to log" implementation — return nil — stopped the heartbeat before a single beat was sent. The host feeds its stall detector solely from log-stream heartbeats and arms it as soon as the stream starts, so such an adapter's sessions were falsely declared crashed after the 90s stall threshold. Honouring the protocol depended on an unwritten rule ("your Log must block until its context is cancelled") that nothing in the signature, docs, or tests communicated.

The SDK now scopes the heartbeat to the stream context, runs impl.Log concurrently, and holds the stream open until the host cancels it.

  • Adapters that return early from Log stay healthy.
  • Adapters that block on <-ctx.Done() are unaffected.
  • A non-nil error from Log still propagates immediately.
  • Heartbeats stop on stream-context cancellation, so genuine stall detection is intact.

Covered by TestLogEarlyReturnKeepsHeartbeats, TestLogBlockingReturnUnchanged, TestLogErrorPropagated, and TestLogHeartbeatsStopOnCancel.

Principle

Protocol-level liveness and stream lifetime are the SDK's responsibility, not the adapter author's. An author writing the most obvious implementation of an interface must not be able to produce an adapter that breaks the host.

For adapter authors

Bump github.com/brokenbots/criteria-go-adapter-sdk to v0.5.3 to pick this up.

Commits
  • 425071c adapterhost: keep log-stream heartbeat alive for stream lifetime (#12)
  • 7ca94dd Merge pull request #2 from brokenbots/security/ws49-ws50-hardening
  • fe269f5 security: osv-scanner gate + dependency policy + docs (WS49/WS50)
  • 593e6f7 feat(remote): reconnect, LoadClientTLS helper, tests & examples for ServeRemo...
  • See full diff in compare view

Updates github.com/sigstore/cosign/v3 from 3.1.2 to 3.1.3

Release notes

Sourced from github.com/sigstore/cosign/v3's releases.

v3.1.3

What's Changed

This release resolves GHSA-fx35-mq7g-6g98, a verification bypass using an unexpected public key in a legacy bundle.

Full Changelog: sigstore/cosign@v3.1.2...v3.1.3

Commits
  • 11926fa Verification bypass via public key in legacy bundle (GHSA-fx35-mq7g-6g98) (#5...
  • 4d589ba fix(blob): compare file checksums case-insensitively (#5036)
  • 83d9ec8 fix: prevent shell completions for various options not taking filenames (#5032)
  • 0238975 test(inspect): replace mock TSA client usage with local timestamp response ge...
  • d6d86c2 Supporting OCI Signing with X.509 Certificate Chain (#4614)
  • a3ee83c fix(pkcs11key): return an error instead of panicking when no key pair matches...
  • d6857f2 Auto-detect default digest algorithm for public keys (#5019)
  • See full diff in compare view

Updates github.com/sigstore/sigstore from 1.10.8 to 1.10.9

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.10.9

What's Changed

Note: sigstore/sigstore#2369 deprecates the TUF client. Use the TUF client from sigstore-go instead: https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf

Full Changelog: sigstore/sigstore@v1.10.8...v1.10.9

Commits
  • ee9fe03 Fix Azure KMS support for RSA signatures (#2355)
  • b34fd13 feat(hashivault): token helper tests (#2176)
  • aed7c8b Dependencies updates (#2384)
  • 05a1d97 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azk...
  • be12908 build(deps): Bump github.com/hashicorp/vault/api (#2351)
  • a8f8715 build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2350)
  • d91673d build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2372)
  • c482e99 build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2347)
  • 6529cc3 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2376)
  • f95e2b7 build(deps): Bump golang.org/x/crypto in /pkg/signature/kms/azure (#2377)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0

Release notes

Sourced from github.com/sigstore/sigstore-go's releases.

v1.3.0

What's Changed

New Contributors

Full Changelog: sigstore/sigstore-go@v1.2.2...v1.3.0

Commits
  • 22d3691 Bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#667)
  • 41fe108 Bump linter, disable goconst, run go fix (#664)
  • ba85fa8 verify: stop materializing in-toto predicates the verifier never reads (#666)
  • 96c07cb Handle 409s from Rekor v1 by fetching the entry (#647)
  • 85e559c Bump the minor-patch group across 1 directory with 2 updates (#662)
  • fe6a5a5 Bump actions/checkout from 7.0.0 to 7.0.1 (#663)
  • fc71b2a fix(verify): prevent nil-pointer panic in TLogEntries (#658)
  • 444ecf7 Bump the minor-patch group across 1 directory with 6 updates (#660)
  • 96894f5 Bump actions/setup-go from 6.5.0 to 7.0.0 (#659)
  • See full diff in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go from 0.43.0 to 0.44.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.44.0

What's Changed

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • 007bd6b chore: use new version (v0.44.0) in modules and examples
  • 6fdd2fd feat: allow overriding the session ID (#3051)
  • 0cfd2f9 chore(deps): bump slackapi/slack-github-action from 3.0.3 to 4.0.0 (#3788)
  • 5dda4cd chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#3789)
  • 8cfecf9 chore(deps): bump docker/setup-docker-action from 5.1.0 to 5.4.0 (#3790)
  • 1d054f6 fix: escape the container name in the Docker name filter (#3837)
  • 2f869d6 fix: should print max information by default (#3459)
  • 62941e8 chore(azurite): tidy module dependencies (#3838)
  • 632ee7b security: fix Dependabot alerts for grpc and OTel (#3835)
  • caa68c6 chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1...
  • Additional commits viewable in compare view

Updates golang.org/x/mod from 0.38.0 to 0.40.0

Commits
  • d3398d0 go.mod: update golang.org/x dependencies
  • 57549bf sumdb: ignore unrelated hashes in Lookup
  • 96f62ae sumdb/tlog: fix TileHashReader authentication bypass
  • 13be902 go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/net from 0.57.0 to 0.58.0

Commits
  • acc78e0 go.mod: update golang.org/x dependencies
  • 90d10f0 internal/http3: delete invalid Content-Length if declared in server handler
  • 08abf4d internal/http3: infer headers when Content-Encoding is set but is empty
  • 8d10596 http2: avoid deadlocks in wrapped ClientConn state callback
  • 99c3b0a http2/hpack: build the table lookup maps lazily, only for encoders
  • 5a920b1 http3: rework registration to allow using a fake network
  • 7fd2842 quic: return an error from Accept after PacketConn reader exits
  • 825111d quic: avoid busy-loop when keep-alive is blocked by congestion control
  • a02ddfa http/httpproxy: prioritize lowercase proxy environment variables
  • 574e5eb quic: halt conn goroutines on close when listener exits early
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.82.1 to 1.83.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.0

Security

  • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
  • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
  • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
  • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

  • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
  • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
  • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
  • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
  • xds: Add support for xDS-based HTTP CONNECT proxies.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
  • xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

  • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
  • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
Commits
  • 4c226da Change version to 1.83.0 (#9228)
  • c198988 Cherrypick 9223 into v1.83.x (#9279)
  • 8ce3ebf Cherrypick PR 9255 into v1.83.x (#9263)
  • e393849 Cherry-pick recent changes from master (#9240)
  • 2a112a8 authz: add onPolicyUpdate callback to authz file watcher (#9142)
  • 1a80fca vet: adds a check to disallow usage of regex.Compile in xDS code (#9216)
  • 26ffdb3 [tls] Add safety check in custom cert verification that peer cert chain is no...
  • 5013974 internal/grpcsync: add ScheduleAndWait to CallbackSerializer (#9162)
  • bd58bc0 internal/transport: increase test timeout locally in TestAccountCheckWindowSi...
  • 484f150 httpfilter/extproc: add check to ensure that response trailer mode must be SE...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 9…
9498ead 
… updates

Bumps the minor-and-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/brokenbots/criteria-go-adapter-sdk](https://github.com/brokenbots/criteria-go-adapter-sdk) | `0.5.2` | `0.5.3` |
| [github.com/sigstore/cosign/v3](https://github.com/sigstore/cosign) | `3.1.2` | `3.1.3` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.8` | `1.10.9` |
| [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) | `1.2.2` | `1.3.0` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |
| [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) | `0.43.0` | `0.44.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.38.0` | `0.40.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.82.1` | `1.83.0` |



Updates `github.com/brokenbots/criteria-go-adapter-sdk` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/brokenbots/criteria-go-adapter-sdk/releases)
- [Commits](brokenbots/criteria-go-adapter-sdk@v0.5.2...v0.5.3)

Updates `github.com/sigstore/cosign/v3` from 3.1.2 to 3.1.3
- [Release notes](https://github.com/sigstore/cosign/releases)
- [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md)
- [Commits](sigstore/cosign@v3.1.2...v3.1.3)

Updates `github.com/sigstore/sigstore` from 1.10.8 to 1.10.9
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.10.8...v1.10.9)

Updates `github.com/sigstore/sigstore-go` from 1.2.2 to 1.3.0
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](sigstore/sigstore-go@v1.2.2...v1.3.0)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

Updates `github.com/testcontainers/testcontainers-go` from 0.43.0 to 0.44.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.43.0...v0.44.0)

Updates `golang.org/x/mod` from 0.38.0 to 0.40.0
- [Commits](golang/mod@v0.38.0...v0.40.0)

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
- [Commits](golang/net@v0.57.0...v0.58.0)

Updates `google.golang.org/grpc` from 1.82.1 to 1.83.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.82.1...v1.83.0)

---
updated-dependencies:
- dependency-name: github.com/brokenbots/criteria-go-adapter-sdk
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/sigstore/cosign/v3
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.10.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/testcontainers/testcontainers-go
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/mod
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants