Skip to content

chore(deps): update go dependencies - #857

Open
red-hat-konflux[bot] wants to merge 1 commit into
release-1.4from
konflux/mintmaker/release-1.4/go-deps
Open

chore(deps): update go dependencies#857
red-hat-konflux[bot] wants to merge 1 commit into
release-1.4from
konflux/mintmaker/release-1.4/go-deps

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp indirect minor v1.35.0 → v1.38.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric indirect minor v0.57.0 → v0.62.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping indirect minor v0.57.0 → v0.62.0
github.com/Microsoft/go-winio indirect patch v0.6.2 → v0.6.4
github.com/avast/retry-go/v4 indirect major v4.7.0 → v5.1.1
github.com/cenkalti/backoff/v5 indirect major v5.0.3 → v7.0.3
github.com/cheggaaa/pb/v3 indirect minor v3.1.6 → v3.3.0
github.com/clipperhouse/uax29/v2 indirect minor v2.2.0 → v2.7.0
github.com/docker/go-connections indirect minor v0.7.0 → v0.8.2
github.com/dustin/go-humanize indirect minor v1.0.1 → v1.1.0
github.com/emicklei/go-restful/v3 indirect minor v3.13.0 → v3.14.0
github.com/fxamacker/cbor/v2 indirect minor v2.9.1 → v2.10.0
github.com/go-jose/go-jose/v4 indirect patch v4.1.6 → v4.1.9
github.com/go-openapi/jsonpointer indirect patch v1.0.0 → v1.0.2
github.com/go-openapi/jsonreference indirect patch v1.0.0 → v1.0.3
github.com/go-openapi/swag indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/cmdutils indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/conv indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/fileutils indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/jsonutils indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/loading indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/mangling indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/netutils indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/pools indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/stringutils indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/typeutils indirect minor v0.28.0 → v0.29.2
github.com/go-openapi/swag/yamlutils indirect minor v0.28.0 → v0.29.2
github.com/gofrs/flock indirect patch v0.13.0 → v0.13.1 v0.13.2
github.com/google/pprof indirect digest 92041b7 → 4bf881d
github.com/google/s2a-go indirect patch v0.1.9 → v0.1.11
github.com/googleapis/enterprise-certificate-proxy indirect patch v0.3.20 → v0.3.25
github.com/googleapis/gax-go/v2 indirect minor v2.24.0 → v2.27.0
github.com/grpc-ecosystem/go-grpc-middleware require major v1.4.0 → v2.3.4
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus indirect patch v1.1.0 → v1.1.1
github.com/grpc-ecosystem/go-grpc-middleware/v2 indirect patch v2.3.3 → v2.3.4
github.com/grpc-ecosystem/grpc-gateway/v2 indirect minor v2.30.0 → v2.33.0
github.com/hashicorp/go-uuid indirect patch v1.0.3 → v1.0.4
github.com/huandu/xstrings indirect minor v1.5.0 → v1.6.3
github.com/imdario/mergo indirect major v0.3.16 → v1.0.2
github.com/jackc/pgx/v4 indirect major v4.18.3 → v5.12.0
github.com/jackc/pgx/v5 require minor v5.11.0 → v5.12.0
github.com/jackc/puddle/v2 indirect patch v2.2.2 → v2.2.3
github.com/jhump/protoreflect indirect major v1.18.0 → v2.0.0
github.com/jhump/protoreflect/v2 indirect patch v2.0.0-beta.1 → v2.0.0
github.com/mattn/go-colorable indirect patch v0.1.14 → v0.1.16
github.com/mattn/go-isatty indirect patch v0.0.22 → v0.0.24
github.com/mattn/go-runewidth indirect patch v0.0.23 → v0.0.31
github.com/moby/moby/api indirect patch v1.56.0 → v1.56.1
github.com/moby/moby/client indirect patch v0.6.0 → v0.6.2
github.com/olekukonko/tablewriter indirect major v0.0.5 → v1.1.5
github.com/onsi/ginkgo indirect major v1.16.5 → v2.34.0
github.com/onsi/gomega indirect minor v1.10.1 → v1.44.0
github.com/pandatix/go-abnf indirect patch v0.5.1 → v0.5.5
github.com/planetscale/vtprotobuf indirect digest ba97887 → 8ae5a48
github.com/prometheus/common indirect patch v0.73.0 → v0.73.1
github.com/prometheus/procfs indirect minor v0.22.0 → v0.23.0
github.com/prometheus/prometheus indirect minor v0.311.3 → v0.316.0
github.com/pseudomuto/protokit indirect minor v0.2.1 → v0.3.0
github.com/sirupsen/logrus indirect minor v1.9.4 → v1.10.2
github.com/spf13/pflag indirect minor v1.0.10 → v1.1.0
github.com/spiffe/go-spiffe/v2 indirect minor v2.8.1 → v2.9.0
go.etcd.io/bbolt indirect minor v1.4.3 → v1.5.0
go.etcd.io/etcd/api/v3 indirect minor v3.6.14 → v3.7.3
go.etcd.io/etcd/client/pkg/v3 indirect minor v3.6.14 → v3.7.3
go.etcd.io/etcd/etcdutl/v3 indirect minor v3.6.14 → v3.7.3
go.etcd.io/etcd/pkg/v3 indirect minor v3.6.14 → v3.7.3
go.etcd.io/etcd/tests/v3 indirect minor v3.6.14 → v3.7.3
go.etcd.io/raft/v3 indirect minor v3.6.0 → v3.7.0
go.opentelemetry.io/contrib/detectors/gcp indirect minor v1.45.0 → v1.47.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc indirect minor v0.70.0 → v0.72.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp indirect minor v0.70.0 → v0.72.0
go.opentelemetry.io/proto/otlp indirect patch v1.11.0 → v1.11.1
go.uber.org/zap indirect minor v1.27.1 → v1.28.0
go.yaml.in/yaml/v2 indirect major v2.4.4 → v4.0.0
go.yaml.in/yaml/v3 indirect major v3.0.5 → v4.0.0
golang.org/x/oauth2 indirect minor v0.37.0 → v0.38.0
golang.org/x/sync require minor v0.24.0 → v0.25.0
golang.org/x/sys require minor v0.49.0 → v0.50.0
golang.org/x/time indirect minor v0.15.0 → v0.16.0
google.golang.org/genproto require digest e75dac1 → d1e00e9
google.golang.org/genproto/googleapis/api require digest 8a89bd6 → d1e00e9
google.golang.org/genproto/googleapis/rpc require digest 8a89bd6 → d1e00e9
gopkg.in/evanphx/json-patch.v4 indirect major v4.13.0 → v5.9.11
gopkg.in/yaml.v2 require major v2.4.0 → v3.0.1
k8s.io/kube-openapi indirect digest d427ff9 → 5bee61f
sigs.k8s.io/json indirect digest 2d32026 → 11ed52e
sigs.k8s.io/structured-merge-diff/v6 indirect major v6.4.2 → v7.0.1

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

GoogleCloudPlatform/opentelemetry-operations-go (github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric)

v0.62.0: v1.38.0/v0.62.0

Compare Source

What's Changed

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.61.0...v0.62.0

v0.61.0: v1.37.0/v0.61.0

Compare Source

What's Changed

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.60.0...v0.61.0

v0.60.0: v1.36.0/v0.60.0

Compare Source

What's Changed
New Contributors

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.59.0...v0.60.0

v0.59.0

Compare Source

What's Changed
New Contributors

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.58.0...v0.59.0

v0.58.0: v1.34.0/v0.58.0

Compare Source

What's Changed

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.57.0...v0.58.0

Microsoft/go-winio (github.com/Microsoft/go-winio)

v0.6.4

Compare Source

What's Changed

Full Changelog: microsoft/go-winio@v0.6.3...v0.6.4

v0.6.3

Compare Source

What's Changed

New Contributors

Full Changelog: microsoft/go-winio@v0.6.2...v0.6.3

avast/retry-go (github.com/avast/retry-go/v4)

v5.1.1

Compare Source

What's Changed

New Contributors

Full Changelog: avast/retry-go@5.1.0...v5.1.1

v5.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: avast/retry-go@5.0.0...v5.1.0

v5.0.1

Compare Source

Patch release — no public API changes.

Bug fixes

  • Backoff delay overflow with very large Delay — the shift cap was computed via math.Log2 on a float64, which underflowed for delays near math.MaxInt64, producing invalid backoff delays. The cap is now derived exactly from the bit length of math.MaxInt64. (#​161)
  • AttemptsForError is now honored when Attempts is 0 (UntilSucceeded) — the per-error budget was previously ignored in the retry-until-success loop; this also fixes a uint underflow when a budget of 0 was configured, which caused infinite retries. (#​163, fixes #​137)
  • Unbounded error accumulation with LastErrorOnly(true) — errors were appended to the internal error log on every attempt even though only the last one is returned, growing memory without bound on long retry runs (e.g. Attempts(math.MaxUint) + context cancellation). Only the last error is retained now; the returned error is unchanged. (#​155, fixes #​118)

Documentation & tooling

  • Clarified the v5 migration for DoWithData → NewWithData[T] (#​152)
  • README is now generated by an in-repo stdlib tool (tools/genreadme) with a CI golden-file check, replacing the unmaintained godocdown — the v5 changelog and doc links now render correctly on both GitHub and pkg.go.dev (#​169, resolves #​77)
  • CI: Go 1.26/1.27 added to the matrix, pre-1.24 Go excluded from macOS runners, Codecov no longer fails Dependabot PRs (#​165, #​166)
  • Development dependency: testify 1.11.1 → 1.12.1 (#​168)

Thanks to @​bensynapse, @​AdamMagued, @​Yanhu007, @​c-tonneslan, @​AruneshDwivedi and @​team-humaki — whose contributions, including the ones superseded during review, shaped this release. 🙏

v5.0.0

Compare Source

What's Changed

New Contributors

Full Changelog: avast/retry-go@4.7.0...v5.0.0

cenkalti/backoff (github.com/cenkalti/backoff/v5)

v7.0.3

Compare Source

v7.0.2

Compare Source

v7.0.1

Compare Source

v7.0.0

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

cheggaaa/pb (github.com/cheggaaa/pb/v3)

v3.3.0

Compare Source

v3.2.1

Compare Source

v3.2.0

Compare Source

v3.1.7

Compare Source

clipperhouse/uax29 (github.com/clipperhouse/uax29/v2)

v2.7.0

Compare Source

v2.6.0

Compare Source

v2.5.0

Compare Source

What's Changed

Breaking change

The returned iterator type from FromString() and FromBytes() is now a pointer. This will not present a problem if you are just using it in the typical way, which is assigning to a local variable and iterating.

If you are embedding this iterator into another object, and therefore declaring its type, this change might break your compilation. You’ll need to change to a pointer type. Apologies if so — this seems like a small enough change that a v3 would be a bit much.

New Contributors

Full Changelog: clipperhouse/uax29@v2.4.0...v2.5.0

v2.4.0

Compare Source

Adds Unicode 16 support

What's Changed

Full Changelog: clipperhouse/uax29@v2.3.0...v2.4.0

v2.3.1

Compare Source

v2.3.0

Compare Source

docker/go-connections (github.com/docker/go-connections)

v0.8.2

Compare Source

What's Changed

  • sockets: preserve configured TLS ALPN protocols
  • ci: add dependabot to update actions
  • ci: update runners to Ubuntu 26.04
  • build(deps): bump actions/checkout from 6.0.2 to 7.0.1
  • build(deps): bump actions/setup-go from 6.3.0 to 7.0.0
  • build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.3.0

Full Changelog: docker/go-connections@v0.8.1...v0.8.2

v0.8.1

Compare Source

v0.8.0

Compare Source

dustin/go-humanize (github.com/dustin/go-humanize)

v1.1.0

Compare Source

emicklei/go-restful (github.com/emicklei/go-restful/v3)

v3.14.0

Compare Source

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.10.0

Compare Source

v2.10 speeds up encoding by up to 2.88× and decoding by up to 1.87× with zero memory regressions (B/op, allocs/op), reduces memory use, adds the toindefarray struct tag option, and fixes bugs. The Contributing Guidelines, Security Policy, and templates were extensively updated.

Encoding sorted nested maps of dynamic JSON-like data to CBOR drops from 70 allocs/op to 1 and from 7.2 KiB/op to 4.0 KiB/op in the benchmarks below. Encoding time.Time, big.Int, Tag and Marshaler values, and decoding into time.Time, big.Int and Tag, use 1 to 2 fewer allocs/op (20% to 50% fewer).

This release does not use Go's unsafe package. Performance in user apps depends on configuration and data.

Tests were refactored and coverage increased to 97.7%. Fuzz tests (not yet public) were also extended. Internal checklists and procedures were updated to reduce potential mistakes.

Performance and Benchmarks

Across all 215 benchmarks, there are zero memory regressions (B/op, allocs/op). Just one benchmark showed a speed dip: Marshal/struct_many_flds_all_omitempty_all_empty/map is ~4-5% slower, but only when a struct has 32 fields that are both omitzero and empty (same scenario with an 8-field struct is now faster).

Benchmarks ran with Go 1.26.10 on linux/amd64 (benchstat n=10, p=0.000):

  • CBOR Speedup by Data Type: groups of different benchmarks summarized per row
  • CBOR Encoding Reflection-Free Speedup: dynamic JSON-like data types and common types
CBOR Speedup by Data Type
Unmarshal Speedup ΔSec/op
Single values (bool, int, float, byte string, text string) 1.10× to 1.51×¹ -8.87% to -33.92%¹
Epoch time, bignum, other tags 1.18× to 1.64× -15.33% to -38.91%
Arrays and maps to non-struct 1.33× to 1.87× -24.63% to -46.49%
Arrays and maps to structs 1.06× to 1.52× -5.46% to -34.40%
Real-world (COSE, CWT, SenML, WebAuthn) 1.35× to 1.64× -26.06% to -39.19%

¹ 2.54× speedup (-60.64%) when decoding into a named []byte type that has methods.

Marshal Speedup ΔSec/op
Single values (bool, int, float, byte slice, string) 1.32× to 1.55× -24.49% to -35.41%
time.Time, big.Int, Tag, Marshaler² 1.15× to 1.63× -12.94% to -38.84%
Slices and maps 1.35× to 2.88× -25.97% to -65.26%
Structs 1.57× to 2.17× -36.37% to -53.96%
Structs with omitempty fields 0.95׳ to 1.35× +5.01%³ to -25.96%
Real-world (COSE, CWT, SenML, WebAuthn) 1.12× to 1.33× -10.66% to -24.77%

² For addressable values (reached through a pointer, struct field, slice element or map value).

³ Only when every field is omitempty and empty: 7.6 ns slower for a 32-field struct, 2.37 ns faster for an 8-field struct. This is the only performance regression in all 215 benchmarks.

CBOR Encoding Reflection-Free Speedup

PR #​870 optimized common types: int, int64, uint, uint64, float64, bool, string, nil, []byte, []any, map[any]any, map[string]any, and map[string]string.

Marshal Benchmark
v2.9.6 → v2.10		 Speedup Time
ΔSec/op		 Memory
ΔB/op		 Memory
ΔAllocs/op
[]any 2.50× -607.5 ns (-60.03%) - -
map[string]any 2.60× -821.9 ns (-61.47%) - -
map[string]string 2.59× -335.9 ns (-61.34%) - -
nested_map[any]any 2.88× -16.542 µs (-65.26%) - -
nested_map[string]any 2.78× -14.201 µs (-64.01%) - -
nested_map[any]any, bw_lex 2.53× -22.36 µs (-60.54%) -3314 (-44.72%) -69 (-98.57%)
nested_map[string]any, bw_lex 2.41× -19.52 µs (-58.54%) -3323 (-44.79%) -69 (-98.57%)
  • bw_lex = SortBytewiseLexical. Memory improvements are from #​774 and #​860.

Upgrade Notes

  • Go 1.24 or newer is required (#​773). All tests (97.7% coverage) pass on Go 1.24-1.27.
  • Pointer-receiver marshal methods (user-implemented methods) are called on the original value instead of a copy when the value is addressable (#​866).
  • Marshal configured to use TagsForbidden returns an error for a big.Int outside [-2^64, 2^64-1], and EncMode creation returns an error for settings that would emit tags if TagsForbidden is also set (#​868).
  • Decoder advances past well-formed data items rejected by DecOptions value or serialization restrictions (e.g. NaN, IndefLength), and Skip skips them without an error (#​872).
  • Marshal configured to emit text-based time returns an error for time.Time outside RFC 3339 limits (#​873).

TinyGo (experimental)

TinyGo support for v2.10.0 is available in tag tinygo-beta/v2.10.0-tinygo0.42 (branch feature/cbor-tinygo-beta). It requires TinyGo 0.42.0 or newer. It is experimental and not fuzz tested. For details, see TinyGo (https://github.com/fxamacker/cbor#tinygo) in the README.

What's Changed

⭐ Features
  • feat: add toindefarray struct tag option for CBOR indefinite-length arrays by @​tdnguyenND in #​770
🚀 Optimizations
🛠 Improvements
🐞 Bug Fixes
🧪 Testing
📖 Documentation
📖 Contributing Guidelines, Security Policy, and Templates
CI / GitHub Actions
🔎 Details
Other Changes
Ported from release-2.9

Already released in v2.9.3 through v2.9.6.

🔎 Details

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux

red-hat-konflux Bot commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: github.com/imdario/mergo@v1.0.2: parsing go.mod:
	module declares its path as: dario.cat/mergo
	        but was required as: github.com/imdario/mergo

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch 4 times, most recently from 5b6ba7b to 275ae08 Compare November 9, 2026 01:23
@red-hat-konflux
chore(deps): update go dependencies
dcef7bc 
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.4/go-deps branch from 275ae08 to dcef7bc Compare November 10, 2026 01:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants