chore(deps): update go dependencies by red-hat-konflux[bot] · Pull Request #684 · securesign/trillian

red-hat-konflux · 2026-05-12T23:22:17Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
cel.dev/expr	indirect	patch	`v0.25.2` → `v0.25.3`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	indirect	minor	`v1.33.0` → `v1.38.0`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric	indirect	minor	`v0.56.0` → `v0.62.0`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping	indirect	minor	`v0.56.0` → `v0.62.0`
github.com/Microsoft/go-winio	indirect	patch	`v0.6.2` → `v0.6.4`
github.com/avast/retry-go/v4	indirect	major	`v4.7.0` → `v5.0.0`
github.com/cenkalti/backoff/v5	indirect	major	`v5.0.3` → `v7.0.2`	`v7.0.3`
github.com/cheggaaa/pb/v3	indirect	minor	`v3.1.6` → `v3.2.1`
github.com/clipperhouse/uax29/v2	indirect	minor	`v2.2.0` → `v2.7.0`
github.com/docker/go-connections	indirect	minor	`v0.7.0` → `v0.8.2`
github.com/dustin/go-humanize	indirect	minor	`v1.0.1` → `v1.1.0`
github.com/emicklei/go-restful/v3	indirect	minor	`v3.13.0` → `v3.14.0`
github.com/envoyproxy/go-control-plane/envoy	indirect	minor	`v1.37.0` → `v1.40.0`
github.com/felixge/httpsnoop	indirect	minor	`v1.0.4` → `v1.1.0`
github.com/fxamacker/cbor/v2	indirect	minor	`v2.9.1` → `v2.10.0`
github.com/go-jose/go-jose/v4	indirect	patch	`v4.1.4` → `v4.1.6`	`v4.1.7`
github.com/go-logr/logr	indirect	patch	`v1.4.3` → `v1.4.4`
github.com/go-openapi/jsonpointer	indirect	major	`v0.23.1` → `v1.0.2`
github.com/go-openapi/jsonreference	indirect	major	`v0.21.5` → `v1.0.3`
github.com/go-openapi/swag	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/cmdutils	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/conv	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/fileutils	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/jsonname	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/jsonutils	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/loading	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/mangling	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/netutils	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/stringutils	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/typeutils	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-openapi/swag/yamlutils	indirect	minor	`v0.26.0` → `v0.29.2`
github.com/go-sql-driver/mysql	require	patch	`v1.10.0` → `v1.10.1`
github.com/gofrs/flock	indirect	patch	`v0.13.0` → `v0.13.1`
github.com/golang-cz/devslog	indirect	patch	`v0.0.15` → `v0.0.17`
github.com/google/pprof	indirect	digest	`92041b7` → `dbd0ed3`
github.com/google/s2a-go	indirect	patch	`v0.1.9` → `v0.1.11`
github.com/googleapis/enterprise-certificate-proxy	indirect	patch	`v0.3.15` → `v0.3.24`
github.com/googleapis/gax-go/v2	indirect	minor	`v2.22.0` → `v2.27.0`
github.com/grpc-ecosystem/go-grpc-middleware	require	major	`v1.4.0` → `v2.3.4`
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus	indirect	patch	`v1.1.0` → `v1.1.1`
github.com/grpc-ecosystem/go-grpc-middleware/v2	indirect	patch	`v2.3.3` → `v2.3.4`
github.com/grpc-ecosystem/grpc-gateway/v2	indirect	minor	`v2.29.0` → `v2.33.0`
github.com/huandu/xstrings	indirect	minor	`v1.5.0` → `v1.6.3`
github.com/imdario/mergo	indirect	major	`v0.3.16` → `v1.0.2`
github.com/jackc/pgx/v4	indirect	major	`v4.18.3` → `v5.11.0`	`v5.12.0`
github.com/jackc/pgx/v5	require	minor	`v5.9.2` → `v5.11.0`	`v5.12.0`
github.com/jackc/puddle/v2	indirect	patch	`v2.2.2` → `v2.2.3`
github.com/jhump/protoreflect	indirect	major	`v1.18.0` → `v2.0.0`
github.com/jhump/protoreflect/v2	indirect	patch	`v2.0.0-beta.1` → `v2.0.0`
github.com/klauspost/compress	indirect	minor	`v1.18.6` → `v1.20.3`
github.com/mattn/go-colorable	indirect	patch	`v0.1.14` → `v0.1.16`
github.com/mattn/go-isatty	indirect	patch	`v0.0.22` → `v0.0.24`
github.com/mattn/go-runewidth	indirect	patch	`v0.0.23` → `v0.0.31`
github.com/olekukonko/tablewriter	indirect	major	`v0.0.5` → `v1.1.5`
github.com/onsi/ginkgo	indirect	major	`v1.16.5` → `v2.33.1`
github.com/planetscale/vtprotobuf	indirect	digest	`ba97887` → `8ae5a48`
github.com/prometheus/client_golang	require	minor	`v1.23.2` → `v1.25.0`
github.com/prometheus/client_model	require	patch	`v0.6.2` → `v0.6.3`
github.com/prometheus/common	indirect	minor	`v0.67.5` → `v0.73.0`	`v0.73.1`
github.com/prometheus/procfs	indirect	minor	`v0.20.1` → `v0.23.0`
github.com/prometheus/prometheus	indirect	minor	`v0.311.3` → `v0.315.1`
github.com/pseudomuto/protokit	indirect	minor	`v0.2.1` → `v0.3.0`
github.com/sirupsen/logrus	indirect	minor	`v1.9.4` → `v1.10.2`
github.com/spiffe/go-spiffe/v2	indirect	minor	`v2.7.0` → `v2.9.0`
github.com/stretchr/testify	indirect	minor	`v1.11.1` → `v1.12.1`
go.etcd.io/bbolt	indirect	minor	`v1.4.3` → `v1.5.0`
go.etcd.io/etcd/api/v3	indirect	minor	`v3.6.14` → `v3.7.3`
go.etcd.io/etcd/client/pkg/v3	indirect	minor	`v3.6.14` → `v3.7.3`
go.etcd.io/etcd/etcdutl/v3	indirect	minor	`v3.6.14` → `v3.7.3`
go.etcd.io/etcd/pkg/v3	indirect	minor	`v3.6.14` → `v3.7.3`
go.etcd.io/etcd/tests/v3	indirect	minor	`v3.6.14` → `v3.7.3`
go.etcd.io/raft/v3	indirect	minor	`v3.6.0` → `v3.7.0`
go.opentelemetry.io/contrib/detectors/gcp	indirect	minor	`v1.44.0` → `v1.47.0`
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	indirect	minor	`v0.69.0` → `v0.72.0`
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	indirect	minor	`v0.69.0` → `v0.72.0`
go.opentelemetry.io/otel	indirect	minor	`v1.44.0` → `v1.47.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	indirect	minor	`v1.44.0` → `v1.47.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	indirect	minor	`v1.44.0` → `v1.47.0`
go.opentelemetry.io/otel/metric	indirect	minor	`v1.44.0` → `v1.47.0`
go.opentelemetry.io/otel/sdk	indirect	minor	`v1.44.0` → `v1.47.0`
go.opentelemetry.io/otel/sdk/metric	indirect	minor	`v1.44.0` → `v1.47.0`
go.opentelemetry.io/otel/trace	indirect	minor	`v1.44.0` → `v1.47.0`
go.opentelemetry.io/proto/otlp	indirect	minor	`v1.10.0` → `v1.11.1`
go.uber.org/zap	indirect	minor	`v1.27.1` → `v1.28.0`
go.yaml.in/yaml/v2	indirect	major	`v2.4.4` → `v3.0.6`
go.yaml.in/yaml/v3	indirect	patch	`v3.0.4` → `v3.0.6`
golang.org/x/crypto	require	minor	`v0.55.0` → `v0.58.0`
golang.org/x/exp	indirect	digest	`74f9aab` → `f0251eb`
golang.org/x/mod	indirect	minor	`v0.38.0` → `v0.42.0`
golang.org/x/net	indirect	minor	`v0.58.0` → `v0.62.0`
golang.org/x/oauth2	indirect	minor	`v0.36.0` → `v0.37.0`
golang.org/x/sync	require	minor	`v0.22.0` → `v0.24.0`
golang.org/x/sys	require	minor	`v0.47.0` → `v0.49.0`
golang.org/x/term	indirect	minor	`v0.45.0` → `v0.47.0`
golang.org/x/text	indirect	minor	`v0.41.0` → `v0.43.0`
golang.org/x/time	indirect	minor	`v0.15.0` → `v0.16.0`
golang.org/x/tools	require	minor	`v0.48.0` → `v0.52.0`
google.golang.org/genproto	require	digest	`3700d41` → `2ffab32`
google.golang.org/genproto/googleapis/api	require	digest	`3dc84a4` → `2ffab32`
google.golang.org/genproto/googleapis/rpc	require	digest	`3dc84a4` → `2ffab32`
google.golang.org/grpc	require	minor	`v1.83.2` → `v1.85.0`
google.golang.org/protobuf	require	patch	`v1.36.12-0.20260120151049-f2248ac996af` → `v1.36.12`
gopkg.in/evanphx/json-patch.v4	indirect	major	`v4.13.0` → `v5.9.11`
gopkg.in/yaml.v2	require	major	`v2.4.0` → `v3.0.1`
k8s.io/api	require	minor	`v0.35.4` → `v0.37.2`
k8s.io/apimachinery	require	minor	`v0.35.4` → `v0.37.2`
k8s.io/client-go	require	minor	`v0.35.4` → `v0.37.2`
k8s.io/kube-openapi	indirect	digest	`da4e56f` → `ca3452a`
k8s.io/utils	require	digest	`ff6756f` → `ca04ba5`
sigs.k8s.io/json	indirect	digest	`2d32026` → `11ed52e`
sigs.k8s.io/structured-merge-diff/v6	indirect	major	`v6.4.0` → `v7.0.1`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

cel-expr/cel-spec (cel.dev/expr)

`v0.25.3`

Compare Source

What's Changed

Workaround inconsistent ? in proto textformat by @jnthntatum in #512
Update README with repository relocation notice by @dmitriplotnikov in #514
Add basic tests for out-of-range epoch int to timestamp conversions by @l46kok in #500
Update README with new repository link by @dmitriplotnikov in #519
Lint fixes for import by @jnthntatum in #521
CEL conformance test documentation: fix links in markdown by @AustinWise in #518
Avoid ? in textproto test cases. by @jnthntatum in #525
Add initial conformance tests for lists ext by @jnthntatum in #528

New Contributors

@dmitriplotnikov made their first contribution in #514
@AustinWise made their first contribution in #518

Full Changelog: cel-expr/cel-spec@v0.25.2...v0.25.3

GoogleCloudPlatform/opentelemetry-operations-go (github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric)

`v0.62.0`: v1.38.0/v0.62.0

Compare Source

What's Changed

exporter/collector/logs: Add support for the gcp.operation attribute by @quentinmit in #1201
Prepare release v1.38.0/v0.62.0 by @quentinmit in #1203

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.61.0...v0.62.0

`v0.61.0`: v1.37.0/v0.61.0

Compare Source

What's Changed

Drop support for go 1.25 by @dashpole in #1190
Deprecate trace and metric exporters and add migration guide by @dashpole in #1192
Deprecate extension/googleclientauthextension module by @dashpole in #1187
fix: update Cloud Functions gen2 e2e test runtime to go126 by @dashpole in #1195
propagator: deprecate package and add missing module-level deprecations by @dashpole in #1196
detectors/gcp: deprecate GCP resource detection package by @dashpole in #1193
Prepare release v1.37.0/v0.61.0 by @dashpole in #1198

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.60.0...v0.61.0

`v0.60.0`: v1.36.0/v0.60.0

Compare Source

What's Changed

Add GKEHostType by @iblancasa in #1177
Update OpenTelemetry dependencies to fix govulncheck GO-2026-5158 by @dashpole in #1185
exporter/trace: update span attribute and event limits to match backend by @dashpole in #1186
Add support for go 1.27 and fix zizimor by @dashpole in #1188
Prepare release v1.36.0/v0.60.0 by @dashpole in #1189

New Contributors

@iblancasa made their first contribution in #1177

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.59.0...v0.60.0

`v0.59.0`

Compare Source

What's Changed

Adds support for resolving OpenTelemetry authentication extensions by @Angelawork in #1181
update golang.org/x/crypto by @braydonk in #1182
Update module google.golang.org/grpc to v1.82.1 [SECURITY] by @renovate-bot in #1184
Prepare release 0.59.0/1.35.0 by @braydonk in #1183

New Contributors

@Angelawork made their first contribution in #1181

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.58.0...v0.59.0

`v0.58.0`: v1.34.0/v0.58.0

Compare Source

What's Changed

googlemanagedprometheus: Add destination_project_quota by @braydonk in #1175
Prepare release v1.34.0/v0.58.0 by @braydonk in #1178

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.57.0...v0.58.0

`v0.57.0`: v1.33.0/v0.57.0

Compare Source

What's Changed

Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] by @renovate-bot in #1146
Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] by @renovate-bot in #1145
Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] by @renovate-bot in #1144
[chore] retry_on_failure is removed from our exporter by @braydonk in #1151
downgrade davecgh/go-spew, pmezard/go-difflib to tagged releases by @thaJeztah in #1152
Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY] by @renovate-bot in #1149
Update e2e-testing image to fix presubmits by @dashpole in #1155
Update go.opentelemetry.io/collector by @renovate-bot in #1073
Auto comment /gcbrun for dependency updates by @dashpole in #1154
Revert "Auto comment /gcbrun for dependency updates" by @dashpole in #1157
Update module github.com/prometheus/common to v0.67.5 by @renovate-bot in #1156
Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.4.0 in /tools by @dependabot[bot] in #1118
Update golang.org/x by @renovate-bot in #1008
Combine dependency bumps by @dashpole in #1158
Update All Dependencies by @renovate-bot in #1161
Update all major dependencies by @dashpole in #1164
Update All Dependencies by @renovate-bot in #1163
Add AGENTS.md by @dashpole in #1165
Fix CodeQL permissions to allow uploading results by @dashpole in #1166
collector: bump golang.org/x/net to v0.55.0 to fix GO-2026-5026 by @dashpole in #1170
Migrate impersonate to use cloud.google.com/go/auth by @dashpole in #1169
fix: Support OTLP event_name field in logs exporter by @putcho01 in #1088
exporter/collector/logs: accept string-typed line in sourceLocation by @alliasgher in #1142
exporter/collector/logs: use parsed httpRequest.protocol instead of hardcoded HTTP/1.1 by @alliasgher in #1143
exporter/trace: sanitize invalid UTF-8 in span fields by @alliasgher in #1141
chore: update E2E tests to use centralized async cleanup 0.22.0 by @aabmass in #1171
Add support for cloud run worker pools by @dashpole in #1112
Prerelease 1.33.0/v0.57.0 by @avilevy18 in #1173

New Contributors

@thaJeztah made their first contribution in #1152
@putcho01 made their first contribution in #1088
@alliasgher made their first contribution in #1142

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.56.0...v0.57.0

Microsoft/go-winio (github.com/Microsoft/go-winio)

`v0.6.4`

Compare Source

What's Changed

Bump golang.org/x/sys from 0.48.0 to 0.49.0 by @dependabot[bot] in microsoft#393
Fix regression in mkwinsyscall for non SystemDLLs by @jterry75 in microsoft#394

Full Changelog: microsoft/go-winio@v0.6.3...v0.6.4

`v0.6.3`

Compare Source

What's Changed

switch back from golang.org/x/sys/execabs to os/exec (go1.19) by @thaJeztah in microsoft#317
Add Go wrappers for Get/SetVirtualDiskInformation win32 APIs. by @ambarve in microsoft#334
Add support for LX symlinks (0xA000001D) for WSL/MSYS2 compatibility by @vagokuln-msft in microsoft#336
backuptar: fix sparse stream handling in seekable exports by @rzlink in microsoft#375
Bump github.com/sirupsen/logrus from 1.9.3 to 1.10.2 by @dependabot[bot] in microsoft#374
Pin GitHub Actions to full-length commit SHAs by @danfiedler-msft in microsoft#373
ci: add windows-2025, remove windows-2019 by @thaJeztah in microsoft#378
Bump actions/checkout from 4.4.0 to 7.0.1 by @dependabot[bot] in microsoft#380
Bump actions/setup-go from 5.6.0 to 7.0.0 by @dependabot[bot] in microsoft#381
go.mod: raise minimum go version to go1.24 and use tools directive by @thaJeztah in microsoft#348
Restrict CI workflow token permissions by @jterry75 with @Copilot in microsoft#382
Use go tool to run stringer by @thaJeztah in microsoft#383
ci: update actions and golangci-lint, and fix linting by @thaJeztah in microsoft#349
fix linting issues by @thaJeztah in microsoft#325
Bump golang.org/x/tools to v0.50.0 by @jterry75 in microsoft#385
Resolves race in makeConnectedServerPipe / Close by @jterry75 in microsoft#388
tools/mkwinsyscall: remove errnoERROR_IO_PENDING const by @thaJeztah in microsoft#260
linting: enable dupword, intrange, mirror, gocritic by @alexandear in microsoft#387
improve interoperability with stdlib sentinel errors and deprecate aliases by @thaJeztah in microsoft#392

New Contributors

@vagokuln-msft made their first contribution in microsoft#336
@rzlink made their first contribution in microsoft#375
@dependabot[bot] made their first contribution in microsoft#374
@danfiedler-msft made their first contribution in microsoft#373
@jterry75 with @Copilot made their first contribution in microsoft#382
@alexandear made their first contribution in microsoft#387

Full Changelog: microsoft/go-winio@v0.6.2...v0.6.3

avast/retry-go (github.com/avast/retry-go/v4)

`v5.0.0`

Compare Source

What's Changed

Use Makefile lint target instead of blocked GitHub Action by @JaSei in #143
default type is combination of backoff and random by @JaSei in #144
Enhance readme + coverage by @JaSei in #146
default branch is main by @JaSei in #147
Proposal for v5 API: retry.New(...).Do(func) by @msf in #148
upgrade to v5.0.0 with Go 1.20 multiple error wrapping support by @JaSei in #149

New Contributors

@msf made their first contribution in #148

Full Changelog: avast/retry-go@4.7.0...v5.0.0

cenkalti/backoff (github.com/cenkalti/backoff/v5)

cheggaaa/pb (github.com/cheggaaa/pb/v3)

`v3.2.1`

Compare Source

`v3.2.0`

Compare Source

`v3.1.7`

Compare Source

clipperhouse/uax29 (github.com/clipperhouse/uax29/v2)

`v2.7.0`

Compare Source

`v2.6.0`

Compare Source

`v2.5.0`

Compare Source

What's Changed

Unicode 17 by @aymanbagabas in #44
Fast paths for ASCII by @clipperhouse in #42

Breaking change

The returned iterator type from FromString() and FromBytes() is now a pointer. This will not present a problem if you are just using it in the typical way, which is assigning to a local variable and iterating.

If you are embedding this iterator into another object, and therefore declaring its type, this change might break your compilation. You’ll need to change to a pointer type. Apologies if so — this seems like a small enough change that a v3 would be a bit much.

New Contributors

@aymanbagabas made their first contribution in #44

Full Changelog: clipperhouse/uax29@v2.4.0...v2.5.0

`v2.4.0`

Compare Source

Adds Unicode 16 support

What's Changed

Unicode 16 by @clipperhouse in #41

Full Changelog: clipperhouse/uax29@v2.3.0...v2.4.0

`v2.3.1`

Compare Source

`v2.3.0`

Compare Source

docker/go-connections (github.com/docker/go-connections)

`v0.8.2`

Compare Source

What's Changed

sockets: preserve configured TLS ALPN protocols
ci: add dependabot to update actions
ci: update runners to Ubuntu 26.04
build(deps): bump actions/checkout from 6.0.2 to 7.0.1
build(deps): bump actions/setup-go from 6.3.0 to 7.0.0
build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.3.0

Full Changelog: docker/go-connections@v0.8.1...v0.8.2

`v0.8.1`

Compare Source

`v0.8.0`

Compare Source

dustin/go-humanize (github.com/dustin/go-humanize)

`v1.1.0`

Compare Source

emicklei/go-restful (github.com/emicklei/go-restful/v3)

`v3.14.0`

Compare Source

envoyproxy/go-control-plane (github.com/envoyproxy/go-control-plane/envoy)

`v1.40.0`

Full Changelog: envoy/v1.39.0...envoy/v1.40.0

`v1.39.0`

Full Changelog: envoy/v1.38.0...envoy/v1.39.0

`v1.38.0`

Full Changelog: envoy/v1.37.0...envoy/v1.38.0

felixge/httpsnoop (github.com/felixge/httpsnoop)

`v1.1.0`

Compare Source

fxamacker/cbor (github.com/fxamacker/cbor/v2)

`v2.10.0`

Compare Source

v2.10 speeds up encoding by up to 2.88× and decoding by up to 1.87× with zero memory regressions (B/op, allocs/op), reduces memory use, adds the toindefarray struct tag option, and fixes bugs. The Contributing Guidelines, Security Policy, and templates were extensively updated.

Encoding sorted nested maps of dynamic JSON-like data to CBOR drops from 70 allocs/op to 1 and from 7.2 KiB/op to 4.0 KiB/op in the benchmarks below. Encoding time.Time, big.Int, Tag and Marshaler values, and decoding into time.Time, big.Int and Tag, use 1 to 2 fewer allocs/op (20% to 50% fewer).

This release does not use Go's unsafe package. Performance in user apps depends on configuration and data.

Tests were refactored and coverage increased to 97.7%. Fuzz tests (not yet public) were also extended. Internal checklists and procedures were updated to reduce potential mistakes.

Performance and Benchmarks

Across all 215 benchmarks, there are zero memory regressions (B/op, allocs/op). Just one benchmark showed a speed dip: Marshal/struct_many_flds_all_omitempty_all_empty/map is ~4-5% slower, but only when a struct has 32 fields that are both omitzero and empty (same scenario with an 8-field struct is now faster).

Benchmarks ran with Go 1.26.10 on linux/amd64 (benchstat n=10, p=0.000):

CBOR Speedup by Data Type: groups of different benchmarks summarized per row
CBOR Encoding Reflection-Free Speedup: dynamic JSON-like data types and common types

CBOR Speedup by Data Type

Unmarshal	Speedup	ΔSec/op
Single values (bool, int, float, byte string, text string)	1.10× to 1.51×¹	-8.87% to -33.92%¹
Epoch time, bignum, other tags	1.18× to 1.64×	-15.33% to -38.91%
Arrays and maps to non-struct	1.33× to 1.87×	-24.63% to -46.49%
Arrays and maps to structs	1.06× to 1.52×	-5.46% to -34.40%
Real-world (COSE, CWT, SenML, WebAuthn)	1.35× to 1.64×	-26.06% to -39.19%

¹ 2.54× speedup (-60.64%) when decoding into a named []byte type that has methods.

Marshal	Speedup	ΔSec/op
Single values (bool, int, float, byte slice, string)	1.32× to 1.55×	-24.49% to -35.41%
time.Time, big.Int, Tag, Marshaler²	1.15× to 1.63×	-12.94% to -38.84%
Slices and maps	1.35× to 2.88×	-25.97% to -65.26%
Structs	1.57× to 2.17×	-36.37% to -53.96%
Structs with omitempty fields	0.95×³ to 1.35×	+5.01%³ to -25.96%
Real-world (COSE, CWT, SenML, WebAuthn)	1.12× to 1.33×	-10.66% to -24.77%

² For addressable values (reached through a pointer, struct field, slice element or map value).

³ Only when every field is omitempty and empty: 7.6 ns slower for a 32-field struct, 2.37 ns faster for an 8-field struct. This is the only performance regression in all 215 benchmarks.

CBOR Encoding Reflection-Free Speedup

PR #870 optimized common types: int, int64, uint, uint64, float64, bool, string, nil, []byte, []any, map[any]any, map[string]any, and map[string]string.

Marshal Benchmark v2.9.6 → v2.10	Speedup	Time ΔSec/op	Memory ΔB/op	Memory ΔAllocs/op
[]any	2.50×	-607.5 ns (-60.03%)	-	-
map[string]any	2.60×	-821.9 ns (-61.47%)	-	-
map[string]string	2.59×	-335.9 ns (-61.34%)	-	-
nested_map[any]any	2.88×	-16.542 µs (-65.26%)	-	-
nested_map[string]any	2.78×	-14.201 µs (-64.01%)	-	-
nested_map[any]any, bw_lex	2.53×	-22.36 µs (-60.54%)	-3314 (-44.72%)	-69 (-98.57%)
nested_map[string]any, bw_lex	2.41×	-19.52 µs (-58.54%)	-3323 (-44.79%)	-69 (-98.57%)

bw_lex = SortBytewiseLexical. Memory improvements are from #774 and #860.

Upgrade Notes

Go 1.24 or newer is required (#773). All tests (97.7% coverage) pass on Go 1.24-1.27.
Pointer-receiver marshal methods (user-implemented methods) are called on the original value instead of a copy when the value is addressable (#866).
Marshal configured to use TagsForbidden returns an error for a big.Int outside [-2^64, 2^64-1], and EncMode creation returns an error for settings that would emit tags if TagsForbidden is also set (#868).
Decoder advances past well-formed data items rejected by DecOptions value or serialization restrictions (e.g. NaN, IndefLength), and Skip skips them without an error (#872).
Marshal configured to emit text-based time returns an error for time.Time outside RFC 3339 limits (#873).

TinyGo (experimental)

TinyGo support for v2.10.0 is available in tag tinygo-beta/v2.10.0-tinygo0.42 (branch feature/cbor-tinygo-beta). It requires TinyGo 0.42.0 or newer. It is experimental and not fuzz tested. For details, see TinyGo (https://github.com/fxamacker/cbor#tinygo) in the README.

What's Changed

⭐ Features

feat: add toindefarray struct tag option for CBOR indefinite-length arrays by @tdnguyenND in #770

🚀 Optimizations

Optimize encoding speed primarily for slices, maps, and structs by @fxamacker in #806
Reduce decoding time up to 17% for all CBOR data types by @fxamacker in #807
Reduce decoding time by inlining well-formedness checks by @fxamacker in #810
Optimize decoding CBOR byte string by @fxamacker in #811
Optimize decoding CBOR text string by up to 16% by @fxamacker in #812
Reduce allocs and bound memory of keyValue pool by @fxamacker in #860
Reduce allocations when encoding addressable values by @fxamacker in #866
Add reflection-free encoding for common types (up to 2.8x faster) by @fxamacker in #870
Reduce allocs to speed up time.Time, Tag, and big.Int by @fxamacker in #886

🛠 Improvements

Update to require go 1.24 and modernize code by @fxamacker in #773
Refactor to use slices.SortFunc (Go 1.21+) by @fxamacker in #774
Small refactor and cleanups by @fxamacker in #815
Refactor encoding functions to prepare for reflection-free path by @fxamacker in #861
Refactor struct field sorter to use slices.SortFunc by @fxamacker in #877

🐞 Bug Fixes

Enforce TagsForbidden for bignums and ByteSliceLaterFormat by @fxamacker in #868
Advance Decoder past restricted CBOR data items by @fxamacker in #872
Reject marshaling out-of-range time.Time to RFC 3339 by @fxamacker in #873
Fix some error messages returned by EncMode() and DecMode() by @fxamacker in #883
Fix float range check when decoding Unix time by @fxamacker in #889

🧪 Testing

Shorten benchmark names by @fxamacker in #816
Move tests and helpers to new files by @fxamacker in #878
Add checkMarshal test helpers by @fxamacker in #879
Add checkUnmarshal test helpers by @fxamacker in #881
Add test helpers for modes, tags, and round

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

red-hat-konflux · 2026-05-13T02:57:18Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.9` -> `1.26.4`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace`	`v1.43.0` -> `v1.44.0`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`	`v1.43.0` -> `v1.44.0`

red-hat-konflux · 2026-07-05T17:40:07Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: github.com/imdario/mergo@v1.0.2: parsing go.mod:
	module declares its path as: dario.cat/mergo
	        but was required as: github.com/imdario/mergo

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

anithapriyanatarajan · 2026-11-02T14:10:43Z

Why this PR fails

go build ./... fails with go: updates to go.mod needed; to update it: go mod tidy. Do not merge as-is.

go.mod edited without go.sum, and go mod tidy was not applied. go.mod has duplicate require lines (for example go-grpc-middleware/v2, yaml.v3 and go.yaml.in/yaml/v3 each appear twice) and an invalid github.com/imdario/mergo v1.0.2 (that module now declares itself as dario.cat/mergo).
Major-version module swaps with no code changes. go-grpc-middleware v1.4.0 became .../v2 v2.3.4 and gopkg.in/yaml.v2 became yaml.v3. The code still imports the old paths (cmd/internal/serverutil, server/interceptor, docs/claimantmodel/...). v2 also removed ChainUnaryServer.
The bumps need a newer Go than release-1.4 uses. The branch and builder (ubi9/go-toolset 9.8) are on Go 1.25.9. These need Go 1.26 or later: client_golang 1.25.0, x/crypto, x/sync, x/sys, x/tools, grpc 1.85.0 and k8s.io/* 0.37.x. Tidy also pulled kube-openapi, which needs Go 1.27.0. This is most likely why Renovate could not run go mod tidy, so it committed go.mod only.

Compatible bumps (mysql, pgx, client_model, protobuf) are in #846.

What to fix in Renovate (proposals, not yet verified)

Enable "postUpdateOptions": ["gomodTidy"], and do not open or auto-update the PR when artifact updates fail.
Disable major gomod updates on release branches (matchBaseBranches: ["/^release-.*/"], matchManagers: ["gomod"], matchUpdateTypes: ["major"], enabled: false), or enable gomodUpdateImportPaths and review them manually.
On release branches, cap or ignore modules that require a newer Go than the go directive (k8s.io/*, golang.org/x/*, google.golang.org/grpc, prometheus/client_golang) using allowedVersions or ignoreDeps, until the builder image moves to Go 1.26 or later.
Check whether the shared securesign/renovate-config//org-inherited-config.json is the better place for this.
Add a CI check that fails fast on go mod tidy drift.

red-hat-konflux · 2026-11-03T02:02:57Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

anithapriyanatarajan · 2026-11-03T18:11:02Z

@tommyd450 @osmman - Closing this PR in favor of #846

red-hat-konflux Bot added the dependencies label May 12, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch from 962162f to 2efd0c6 Compare May 13, 2026 02:57

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch 17 times, most recently from 68fd81e to 30b0338 Compare May 22, 2026 06:26

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch 10 times, most recently from 01893b3 to 3f52370 Compare May 28, 2026 02:54

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch 11 times, most recently from a5cc312 to e38fdd2 Compare June 5, 2026 14:22

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch 13 times, most recently from 97e43a3 to df4bcda Compare June 20, 2026 18:26

chore(deps): update go dependencies

60bd701

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

anithapriyanatarajan mentioned this pull request Nov 2, 2026

fix(deps): move release-1.4 to Go 1.26 and apply pending dependency bumps #846

Merged

Navigation Menu

Repository navigation

chore(deps): update go dependencies - #684

chore(deps): update go dependencies#684
red-hat-konflux[bot] wants to merge 1 commit into
release-1.4from
konflux/mintmaker/release-1.4/go-deps

red-hat-konflux Bot commented May 12, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented May 13, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Jul 5, 2026

Uh oh!

anithapriyanatarajan commented Nov 2, 2026

Uh oh!

red-hat-konflux Bot commented Nov 3, 2026

Uh oh!

anithapriyanatarajan commented Nov 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

red-hat-konflux Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

v0.62.0: v1.38.0/v0.62.0

What's Changed

v0.61.0: v1.37.0/v0.61.0

What's Changed

v0.60.0: v1.36.0/v0.60.0

What's Changed

New Contributors

What's Changed

New Contributors

v0.58.0: v1.34.0/v0.58.0

What's Changed

v0.57.0: v1.33.0/v0.57.0

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Breaking change

New Contributors

What's Changed

What's Changed

Performance and Benchmarks

CBOR Speedup by Data Type

CBOR Encoding Reflection-Free Speedup

Upgrade Notes

TinyGo (experimental)

What's Changed

⭐ Features

🚀 Optimizations

🛠 Improvements

🐞 Bug Fixes

🧪 Testing

Configuration

Documentation

Uh oh!

red-hat-konflux Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

red-hat-konflux Bot commented Jul 5, 2026

⚠️ Artifact update problem

File name: go.sum

Uh oh!

anithapriyanatarajan commented Nov 2, 2026

Why this PR fails

What to fix in Renovate (proposals, not yet verified)

Uh oh!

red-hat-konflux Bot commented Nov 3, 2026

Edited/Blocked Notification

Uh oh!

anithapriyanatarajan commented Nov 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

red-hat-konflux Bot commented May 12, 2026 •

edited

Loading

`v0.62.0`: v1.38.0/v0.62.0

`v0.61.0`: v1.37.0/v0.61.0

`v0.60.0`: v1.36.0/v0.60.0

`v0.58.0`: v1.34.0/v0.58.0

`v0.57.0`: v1.33.0/v0.57.0

red-hat-konflux Bot commented May 13, 2026 •

edited

Loading