deps: bump the all-go-dependencies group across 1 directory with 7 updates by dependabot[bot] · Pull Request #194 · chainreactors/cyber-harness

dependabot · 2026-11-01T20:08:30Z

Bumps the all-go-dependencies group with 7 updates in the / directory:

Package	From	To
github.com/carapace-sh/carapace	`1.16.3`	`1.17.1`
github.com/mark3labs/mcp-go	`1.3.0`	`1.4.0`
github.com/projectdiscovery/gologger	`1.1.73`	`1.1.75`
github.com/projectdiscovery/utils	`0.11.9`	`0.11.10`
golang.org/x/term	`0.46.0`	`0.47.0`
modernc.org/sqlite	`1.60.1`	`1.61.0`
golang.org/x/net	`0.59.0`	`0.61.0`

Updates github.com/carapace-sh/carapace from 1.16.3 to 1.17.1

Release notes

Sourced from github.com/carapace-sh/carapace's releases.

v1.17.1

Changelog

19079445e46aa5846fe786f7c183c95a1c86fc32 Merge pull request #1317 from carapace-sh/snippet-name-safety

ad515809c5fc2e9c2264e6c80aabdbb145bc6a20 validate completer names and quote snippet interpolation

v1.17.0

Changelog

d316ac656b8ca2f38785d59c467d66b3f77a3db9 Merge pull request #1313 from carapace-sh/xdg-datadirs

1dba51a8ad84641f99dc34b276f52600a18244f0 Merge pull request #1315 from carapace-sh/fix/windows-tests-followup

73e944efd3c7edacc91a4bca0f227afb790fba1e Fix test portability for windows and macos CI

3dd6514e15399c986eb4bb3f8381eb2dc275f59f Add xdg.DataDirs for system-wide data base directories

92b658c3bebda05dc66c555e0f982eca06365df1 Merge pull request #1314 from carapace-sh/fix/windows-macos-tests

1d3d0687bf4fa456cb283c9654b0cc1999a0c514 Fix test portability for windows and macos CI

e9be712ab24a004347b456119f55297a0e4a0a25 Merge pull request #1307 from carapace-sh/ci/windows-macos

889c778c6d75029e00e31e564b576046a1ac5125 Fix xonsh fallback to default completers on empty results

0fea07772b632738718f392da9498f5e45a22342 Merge pull request #1312 from carapace-sh/dependabot/github_actions/github/codeql-action-4.39.0

c84609ea16b889e607ea35cb3903e04583fb62ef build(deps): bump github/codeql-action from 4.38.3 to 4.39.0

c6e063364c305d03f971b141731393237fe88725 Merge pull request #1310 from carapace-sh/dependabot/github_actions/github/codeql-action-4.38.3

5dd5fe0d6ca99f5d456ea7b9c00e1b4626001b65 build(deps): bump github/codeql-action from 4.38.2 to 4.38.3

2383f3c99287dc08eda0bd0673a77d3f7d8ddf8b Merge pull request #1309 from carapace-sh/dependabot/go_modules/github.com/carapace-sh/carapace-shlex/v2-2.0.0

058d633d5050451b51cb6b31e23e2cbf4049ba3e build(deps): bump github.com/carapace-sh/carapace-shlex/v2

61db068b49fc8e05d430fdba93f1be04a256c695 ci: test on windows and macos

v1.17.0-alpha

Changelog

8f5da104a36551b03a2bf4ddb2597758a5733fdb Merge pull request #1259 from carapace-sh/shlex-v2

cbbe8a6b5f7827975218543818d11c280fa20ba4 Migrate to carapace-shlex v2

28f21201618c1facc55b5e48db94411a7f4a496b Merge pull request #1306 from scop/refactor/go-yaml-in

b57e29796a5a3551610648469c63378e4d6ace77 Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3, upgrade to v3.0.5

3704f95d5ed4ff694433f0619065ed3c63cbcf6d Merge pull request #1305 from carapace-sh/dependabot/github_actions/github/codeql-action-4.38.2

0644e2ca330de3cbf52af87a09364d611cd3f127 build(deps): bump github/codeql-action from 4.38.1 to 4.38.2

f466b3f9919c2e42228f9fb7d61e5c02198941ff Merge pull request #1303 from carapace-sh/keyword-styles

81f369f89f297e12fbe51caaab2f99c852c7c734 Add common keyword styles for polarity values

6aba2fd3957c943651a30e6eaee260d23d78c711 Merge pull request #1302 from carapace-sh/docs/skill-update-noPrefix-multi-completer

651594c3196d60c6c58cef32993de22d1b288fcf Update carapace-dev skill to reflect recent codebase changes

Commits

1907944 Merge pull request #1317 from carapace-sh/snippet-name-safety
ad51580 validate completer names and quote snippet interpolation
d316ac6 Merge pull request #1313 from carapace-sh/xdg-datadirs
1dba51a Merge pull request #1315 from carapace-sh/fix/windows-tests-followup
73e944e Fix test portability for windows and macos CI
3dd6514 Add xdg.DataDirs for system-wide data base directories
92b658c Merge pull request #1314 from carapace-sh/fix/windows-macos-tests
1d3d068 Fix test portability for windows and macos CI
e9be712 Merge pull request #1307 from carapace-sh/ci/windows-macos
889c778 Fix xonsh fallback to default completers on empty results
Additional commits viewable in compare view

Updates github.com/mark3labs/mcp-go from 1.3.0 to 1.4.0

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v1.4.0

What's Changed

fix(mcp): preserve integer request IDs across decoding and cancellation by @mikamikasuki in mark3labs/mcp-go#1032

fix(server): replace resource and prompt registries atomically by @rudycelekli in mark3labs/mcp-go#1072

fix(server): unlock when Start fails with a conflicting address by @hmdsefi in mark3labs/mcp-go#1083

fix(server): generate unique in-process session IDs by @pbednarcik in mark3labs/mcp-go#1091

fix(server): order task hooks; a cancel during the created hook reaches the handler by @pbednarcik in mark3labs/mcp-go#1093

fix(mcp): distinguish package paths in schema cache keys by @po-et in mark3labs/mcp-go#1094

fix: clean up stdio processes when Close races with startup by @allenflux in mark3labs/mcp-go#1095

fix(server): render validation errors with jsonschema LocalizedString by @SamuelMolero26 in mark3labs/mcp-go#1099

test(transport): make the SSE custom client timeout test deterministic by @raven-clown in mark3labs/mcp-go#1100

fix(otel): leave nil _meta nil when there is no trace context to inject by @rudycelekli in mark3labs/mcp-go#1101

fix(server): process the final stdio message when it has no trailing newline by @rudycelekli in mark3labs/mcp-go#1103

fix(mcp): retain fixed array lengths in schema tag fallback by @rudycelekli in mark3labs/mcp-go#1056

fix(mcp): recognize pointer protocol errors in classification helpers by @rudycelekli in mark3labs/mcp-go#1058

fix(server): avoid overflow with large positive pagination limits by @rudycelekli in mark3labs/mcp-go#1062

fix(server): invoke middleware factories outside registration lock by @rudycelekli in mark3labs/mcp-go#1068

fix(server): stop dropping notifications when no event store is configured by @Sriram-PR in mark3labs/mcp-go#1097

fix(oauth): derive fallback endpoints from server origin by @skulitom in mark3labs/mcp-go#1098

fix(transport): reset the SSE event type after an event with no data by @rudycelekli in mark3labs/mcp-go#1104

fix(client): retain registered resource subscriptions for Listen by @rudycelekli in mark3labs/mcp-go#1064

fix(oauth): send application_type during dynamic client registration by @po-et in mark3labs/mcp-go#1003

feat(oauth): bind authorization callbacks to their initiating transaction by @po-et in mark3labs/mcp-go#1006

New Contributors

@Sriram-PR made their first contribution in mark3labs/mcp-go#1097

@skulitom made their first contribution in mark3labs/mcp-go#1098

Full Changelog: mark3labs/mcp-go@v1.3.0...v1.4.0

Commits

84ad98e feat(oauth): bind authorization callbacks to their initiating transaction (#1...
cac41e0 fix(oauth): send application_type during dynamic client registration (#1003)
75424c7 fix(client): retain registered resource subscriptions for Listen (#1064)
8824682 fix(transport): reset the SSE event type after an event with no data (#1104)
a4c700b fix(oauth): derive fallback endpoints from server origin (#1098)
606be9b fix(server): stop dropping notifications when no event store is configured (#...
69786db fix(server): invoke middleware factories outside registration lock (#1068)
8f6eeeb fix(server): positive pagination overflow (#1062)
d813bb7 fix(mcp): recognize pointer protocol errors in classification helpers (#1058)
e335af8 fix(mcp): retain fixed array lengths in schema tag fallback (#1056)
Additional commits viewable in compare view

Updates github.com/projectdiscovery/gologger from 1.1.73 to 1.1.75

Release notes

Sourced from github.com/projectdiscovery/gologger's releases.

Release v1.1.75

1.1.75 (2026-11-01)

Release v1.1.74

1.1.74 (2026-10-25)

Commits

9140dfd Merge pull request #162 from projectdiscovery/dependabot/go_modules/main/gith...
2dd601c chore(deps): bump github.com/projectdiscovery/utils
6ed4fbb Merge pull request #161 from projectdiscovery/dependabot/go_modules/main/gith...
1fa6d41 order steps
7040e1f fix ci
0181c40 Merge pull request #159 from projectdiscovery/dependabot/github_actions/main/...
23b0271 chore(deps): bump github.com/projectdiscovery/utils
f3aa263 chore(deps): bump mathieudutour/github-tag-action from 6.2 to 7
See full diff in compare view

Updates github.com/projectdiscovery/utils from 0.11.9 to 0.11.10

Release notes

Sourced from github.com/projectdiscovery/utils's releases.

v0.11.10

Automatically released using projectdiscovery/actions/svu-next action.

What's Changed

copy byte slices given to NewReusableReadCloser by @dogancanbakir in projectdiscovery/utils#796

chore(deps): bump the modules group with 3 updates by @dependabot[bot] in projectdiscovery/utils#794

Build against zcrypto TLS 1.3 by @Mzack9999 in projectdiscovery/utils#793

chore(deps): bump the modules group with 3 updates by @dependabot[bot] in projectdiscovery/utils#801

Full Changelog: projectdiscovery/utils@v0.11.9...v0.11.10

Commits

e7ff3fb Merge pull request #801 from projectdiscovery/dependabot/go_modules/main/modu...
dfac5fc chore(deps): bump the modules group with 3 updates
9ee68a7 Merge pull request #793 from projectdiscovery/bump-zcrypto
1b78a31 Merge remote-tracking branch 'origin/main' into bump-zcrypto
a50d3b8 fix semaphore Vary shrink and buffer pool slot leak
438fc14 Merge pull request #794 from projectdiscovery/dependabot/go_modules/main/modu...
d159861 Merge pull request #796 from projectdiscovery/fix/795-reusable-reader-copy
10aed69 test readers
a599cac fix: copy byte slices given to NewReusableReadCloser
645a3a3 chore(deps): bump the modules group with 3 updates
Additional commits viewable in compare view

Updates golang.org/x/term from 0.46.0 to 0.47.0

Commits

0851034 go.mod: update golang.org/x dependencies
See full diff in compare view

Updates modernc.org/sqlite from 1.60.1 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

2026-10-31 v1.61.1:

Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@requilence)!

Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!

Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.

Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!

The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.

Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

2026-10-21 v1.61.0:

Upgrade to SQLite 3.54.1, re-vendoring lib/ from modernc.org/libsqlite3 v1.15.2 and vec/ from modernc.org/libsqlite_vec v0.7.0; sqlite-vec stays v0.1.9. The pinned modernc.org/libc becomes v1.79.0; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

Add _time_format=string_no_monotonic, opt-in: times are written in the default layout but without Go's monotonic clock reading, the m=+... suffix, so a scanned time matches its row again when bound in WHERE col = ?. The default is unchanged. Resolves [GitLab issue #259](https://gitlab.com/cznic/sqlite/-/issues/259). See [GitLab merge request #142](https://gitlab.com/cznic/sqlite/-/merge_requests/142), thanks 不插电 (@r27153733)!

Each release tag now gets a signed provenance document, linked from its GitLab release; VERIFYING.md says what it proves and how to check one. Tooling only. See [GitLab merge request #141](https://gitlab.com/cznic/sqlite/-/merge_requests/141).

Add an opt-in SQLite authorizer per connection: AuthorizerRegisterer, reached through sql.Conn.Raw or installed on every pooled connection from RegisterConnectionHook; existing connections are unchanged. Resolves [GitLab issue #256](https://gitlab.com/cznic/sqlite/-/issues/256). See [GitLab merge request #139](https://gitlab.com/cznic/sqlite/-/merge_requests/139), thanks Tedla Brandsema (@TedlaBrandsema)!

Closing a connection now forgets the pre-update, commit and rollback hooks registered on it; their entries used to linger after Close.

With a shared cache, BeginTx now waits for a lock another connection holds instead of failing at once with SQLITE_LOCKED_SHAREDCACHE (262), as executing BEGIN IMMEDIATE did; Commit and Rollback wait likewise while another connection changes the schema. busy_timeout does not bound the wait; the call's context does. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!

PrepareContext and BeginTx with a context that is already done now return the context's error, as ExecContext and QueryContext do. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!

A context that is done before a statement starts running, for example while its arguments are being bound, now stops the statement within 1000 VM steps. SQLite discarded that interrupt, so a long statement ran to completion and only then returned the context's error. See [GitHub pull request #9](modernc-org/sqlite#9), thanks Chris Gianelloni (@wolf31o2)!

A statement waiting for a lock under busy_timeout now stops waiting once its context is done, with the context's error, instead of sleeping on until the timeout; the wait's retry schedule and its bound are otherwise unchanged, and so is a call without a deadline. PrepareContext ended this way returns the context's error too, where it returned SQLITE_BUSY. Resolves [GitLab issue #262](https://gitlab.com/cznic/sqlite/-/issues/262), thanks SirLouen!

2026-09-29 v1.60.1:

Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

2026-09-28 v1.60.0:

A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!

Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.

make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).

vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.

Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.

The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.

Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.

Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.

Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.

Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.

Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.

Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.

Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

2026-09-15 v1.59.0:

Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).

Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!

Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

2026-09-01 v1.58.0:

Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

... (truncated)

Commits

4df1ebe sqlite, conn, stmt, tx: end a busy_timeout wait when the call's context is done
44ae8d4 update dependencies, make vendor: SQLite 3.54.1, libc v1.79.0
570dc56 CHANGELOG.md: context cancellation before a statement starts (GitHub PR #9)
4eacffe sqlite, conn: keep one cancellation flag per connection
4926b7a Merge GitHub pull request #9 'fix/context-cancellation'
3587a68 fix: preserve cancellation before SQLite execution
fd37819 Merge branch 'tx-shared-cache-wait' into 'master'
75b4e62 conn: watch the context only while waiting for a shared-cache lock
5856ee8 tx, conn: wait for a shared-cache lock in BeginTx, Commit and Rollback, and e...
0fc3f90 conn: forget the pre-update, commit and rollback hooks on Close
Additional commits viewable in compare view

Updates golang.org/x/net from 0.59.0 to 0.61.0

Commits

c1d31df go.mod: update golang.org/x dependencies
8456a20 quic: properly check for allowed frame types in a packet
18ece0c http2: prevent crash due to HPACK encoder race
2d03f9d http2: avoid 2x refund on stream close with buffered data
cc7d34f http2: avoid excessive work on initial window changes
57f4235 http2: apply header limits to Trailer headers too
01e3d03 http2: coalesce dials via wrapped Transport.RoundTrip
2824783 http2: delete malformed framing-related headers
b13c0c1 internal/http3: delete HTTP/3 package
520c891 quic: off-path support in loss/congestion/rtt
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the all-go-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/carapace-sh/carapace](https://github.com/carapace-sh/carapace) | `1.16.3` | `1.17.1` | | [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) | `1.3.0` | `1.4.0` | | [github.com/projectdiscovery/gologger](https://github.com/projectdiscovery/gologger) | `1.1.73` | `1.1.75` | | [github.com/projectdiscovery/utils](https://github.com/projectdiscovery/utils) | `0.11.9` | `0.11.10` | | [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.60.1` | `1.61.0` | | [golang.org/x/net](https://github.com/golang/net) | `0.59.0` | `0.61.0` | Updates `github.com/carapace-sh/carapace` from 1.16.3 to 1.17.1 - [Release notes](https://github.com/carapace-sh/carapace/releases) - [Commits](carapace-sh/carapace@v1.16.3...v1.17.1) Updates `github.com/mark3labs/mcp-go` from 1.3.0 to 1.4.0 - [Release notes](https://github.com/mark3labs/mcp-go/releases) - [Commits](mark3labs/mcp-go@v1.3.0...v1.4.0) Updates `github.com/projectdiscovery/gologger` from 1.1.73 to 1.1.75 - [Release notes](https://github.com/projectdiscovery/gologger/releases) - [Commits](projectdiscovery/gologger@v1.1.73...v1.1.75) Updates `github.com/projectdiscovery/utils` from 0.11.9 to 0.11.10 - [Release notes](https://github.com/projectdiscovery/utils/releases) - [Changelog](https://github.com/projectdiscovery/utils/blob/main/CHANGELOG.md) - [Commits](projectdiscovery/utils@v0.11.9...v0.11.10) Updates `golang.org/x/term` from 0.46.0 to 0.47.0 - [Commits](golang/term@v0.46.0...v0.47.0) Updates `modernc.org/sqlite` from 1.60.1 to 1.61.0 - [Release notes](https://gitlab.com/cznic/sqlite/tags) - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0) Updates `golang.org/x/net` from 0.59.0 to 0.61.0 - [Commits](golang/net@v0.59.0...v0.61.0) --- updated-dependencies: - dependency-name: github.com/carapace-sh/carapace dependency-version: 1.17.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/mark3labs/mcp-go dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/projectdiscovery/gologger dependency-version: 1.1.75 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/projectdiscovery/utils dependency-version: 0.11.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: golang.org/x/term dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: modernc.org/sqlite dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: golang.org/x/net dependency-version: 0.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-11-01T20:08:32Z

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Navigation Menu

Repository navigation

deps: bump the all-go-dependencies group across 1 directory with 7 updates - #194

deps: bump the all-go-dependencies group across 1 directory with 7 updates#194
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/all-go-dependencies-6792e2e2b8

dependabot Bot commented on behalf of github Nov 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 1, 2026

v1.17.1

Changelog

v1.17.0

Changelog

v1.17.0-alpha

Changelog

Release v1.4.0

What's Changed

New Contributors

Release v1.1.75

1.1.75 (2026-11-01)

Release v1.1.74

1.1.74 (2026-10-25)

v0.11.10

What's Changed

Changelog

Uh oh!

dependabot Bot commented on behalf of github Nov 1, 2026

Labels

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants