Skip to content

🌱(deps): Bump the all-go-deps group across 1 directory with 6 updates - #481

Merged
mhutchinson merged 1 commit into
mainfrom
dependabot/go_modules/all-go-deps-4befdb0561
Nov 9, 2026
Merged

🌱(deps): Bump the all-go-deps group across 1 directory with 6 updates#481
mhutchinson merged 1 commit into
mainfrom
dependabot/go_modules/all-go-deps-4befdb0561

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-go-deps group with 6 updates in the / directory:

Package From To
cloud.google.com/go/cloudsqlconn 1.25.3 1.26.0
github.com/mattn/go-sqlite3 1.14.52 1.14.53
github.com/prometheus/client_golang 1.24.1 1.25.0
golang.org/x/mod 0.41.0 0.42.0
golang.org/x/sync 0.24.0 0.25.0
google.golang.org/grpc 1.84.0 1.85.0

Updates cloud.google.com/go/cloudsqlconn from 1.25.3 to 1.26.0

Release notes

Sourced from cloud.google.com/go/cloudsqlconn's releases.

v1.26.0

1.26.0 (2026-10-29)

Features

v1.25.4

1.25.4 (2026-10-14)

Bug Fixes

Security / CVE Fixes

Updates golang.org/x/net from v0.59.0 to v0.61.0, resolving the following HTTP/2 vulnerabilities:

Advisory CVE Description Affected Package Fixed Version
GO-2026-6603 CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers golang.org/x/net v0.61.0
GO-2026-6610 CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers golang.org/x/net v0.61.0
GO-2026-6611 CVE-2026-78669 Excessive CPU consumption from repeated initial window changes golang.org/x/net v0.61.0
GO-2026-6612 CVE-2026-78663 Double flow control refund on HTTP/2 server streams golang.org/x/net v0.61.0
GO-2026-6617 CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race golang.org/x/net v0.61.0
Changelog

Sourced from cloud.google.com/go/cloudsqlconn's changelog.

1.26.0 (2026-10-29)

Features

  • add built-in client metrics exported to Cloud Monitoring, on by default (BETA) (#1123) (a814420)

1.25.4 (2026-10-14)

Bug Fixes

Security / CVE Fixes

Updates golang.org/x/net from v0.59.0 to v0.61.0, resolving the following HTTP/2 vulnerabilities:

Advisory CVE Description Affected Package Fixed Version
GO-2026-6603 CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers golang.org/x/net v0.61.0
GO-2026-6610 CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers golang.org/x/net v0.61.0
GO-2026-6611 CVE-2026-78669 Excessive CPU consumption from repeated initial window changes golang.org/x/net v0.61.0
GO-2026-6612 CVE-2026-78663 Double flow control refund on HTTP/2 server streams golang.org/x/net v0.61.0
GO-2026-6617 CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race golang.org/x/net v0.61.0
Commits
  • 7f5e5b9 chore(main): release 1.26.0 (#1201)
  • fc340ae deps: update dependencies to latest (#1192)
  • a814420 feat: add built-in client metrics exported to Cloud Monitoring, on by default...
  • 6797309 chore(main): release 1.25.4 (#1172)
  • d6088c5 fix: Update dependencies (#1171)
  • 3414344 deps: update all dependencies to latest (#1170)
  • 70e1852 ci: remove pull_request_review trigger from multi-approvers workflow (#1169)
  • ea5e6aa docs: add note on pgx v5.11.0+ keyword/value connection string escaping (#1166)
  • See full diff in compare view

Updates github.com/mattn/go-sqlite3 from 1.14.52 to 1.14.53

Release notes

Sourced from github.com/mattn/go-sqlite3's releases.

1.14.53

What's Changed

New Contributors

Full Changelog: mattn/go-sqlite3@v1.14.52...v1.14.53

Commits
  • 93c7e0a Merge pull request #1472 from mattn/sqlite-amalgamation-3540100
  • 7b48c65 Upgrade SQLite to version 3540100
  • 45f73f2 Merge pull request #1471 from CovenantSQL/fix/exec-no-args-missing-params
  • 9987c4a Report missing arguments when Exec has no arguments
  • dbbe931 Merge pull request #1462 from mattn/fix-conn-use-after-close
  • a5779f8 Return an error instead of crashing when a connection is used after Close
  • 068ac77 Merge pull request #1458 from ryanchou1994/fix/release-replaced-authorizers
  • 16e3346 fix: guard the authorizer handle with a dedicated mutex
  • 01bfa14 fix: release replaced authorizer callbacks
  • 8a80543 Merge pull request #1460 from mattn/perf-fused-next-step
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Updates golang.org/x/mod from 0.41.0 to 0.42.0

Commits
  • b5136e5 sumdb/tlog: use recorded responses in TestCertificateTransparency
  • 1e9a5ae go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/sync from 0.24.0 to 0.25.0

Commits

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

  • stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)

Bug Fixes

  • transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
  • server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
  • server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
  • xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 9, 2026
@mhutchinson

mhutchinson commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
🌱(deps): Bump the all-go-deps group across 1 directory with 6 updates
eb44e00 
Bumps the all-go-deps group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/cloudsqlconn](https://github.com/googlecloudplatform/cloud-sql-go-connector) | `1.25.3` | `1.26.0` |
| [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.52` | `1.14.53` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.41.0` | `0.42.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.24.0` | `0.25.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.84.0` | `1.85.0` |



Updates `cloud.google.com/go/cloudsqlconn` from 1.25.3 to 1.26.0
- [Release notes](https://github.com/googlecloudplatform/cloud-sql-go-connector/releases)
- [Changelog](https://github.com/GoogleCloudPlatform/cloud-sql-go-connector/blob/main/CHANGELOG.md)
- [Commits](GoogleCloudPlatform/cloud-sql-go-connector@v1.25.3...v1.26.0)

Updates `github.com/mattn/go-sqlite3` from 1.14.52 to 1.14.53
- [Release notes](https://github.com/mattn/go-sqlite3/releases)
- [Commits](mattn/go-sqlite3@v1.14.52...v1.14.53)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `golang.org/x/mod` from 0.41.0 to 0.42.0
- [Commits](golang/mod@v0.41.0...v0.42.0)

Updates `golang.org/x/sync` from 0.24.0 to 0.25.0
- [Commits](golang/sync@v0.24.0...v0.25.0)

Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.84.0...v1.85.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/cloudsqlconn
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: github.com/mattn/go-sqlite3
  dependency-version: 1.14.53
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-deps
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: golang.org/x/mod
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
- dependency-name: google.golang.org/grpc
  dependency-version: 1.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/all-go-deps-4befdb0561 branch from 8e75e58 to eb44e00 Compare November 9, 2026 12:22
@mhutchinson
mhutchinson merged commit f6a412d into main Nov 9, 2026
16 checks passed
@mhutchinson
mhutchinson deleted the dependabot/go_modules/all-go-deps-4befdb0561 branch November 9, 2026 12:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mhutchinson mhutchinson mhutchinson approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mhutchinson