Skip to content

gomod(deps): Bump the go-deps group across 1 directory with 13 updates - #606

Closed
dependabot[bot] wants to merge 1 commit into
prod-stagingfrom
dependabot/go_modules/prod-staging/go-deps-b25bf7086a
Closed

gomod(deps): Bump the go-deps group across 1 directory with 13 updates#606
dependabot[bot] wants to merge 1 commit into
prod-stagingfrom
dependabot/go_modules/prod-staging/go-deps-b25bf7086a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 13 updates in the / directory:

Package From To
charm.land/bubbletea/v2 2.0.10 2.1.1
github.com/alecthomas/kong 1.16.1 1.17.0
github.com/charmbracelet/x/ansi 0.11.8 0.11.9
github.com/containerd/containerd/v2 2.4.1 2.4.2
github.com/docker/cli 29.8.1+incompatible 29.9.2+incompatible
github.com/jotaen/kong-completion 0.0.14 0.0.15
github.com/moby/buildkit 0.31.1 0.34.2
github.com/posthog/posthog-go 1.27.0 1.39.0
github.com/tidwall/gjson 1.19.0 1.20.0
github.com/tonistiigi/fsutil 0.0.0-20260819142231-83cac42c1c52 0.0.0-20261103091533-a72de9dcf763
golang.org/x/mod 0.41.0 0.42.0
golang.org/x/sync 0.23.0 0.24.0
golang.org/x/text 0.42.0 0.43.0

Updates charm.land/bubbletea/v2 from 2.0.10 to 2.1.1
Updates github.com/alecthomas/kong from 1.16.1 to 1.17.0

Commits
  • af6c651 fix: reject default command flags before a sibling command (#679)
  • 24be2f9 fix: allow empty fallback in variable interpolation
  • a60008c Add last-wins flag groups (#653)
  • b778e12 Propagate envprefix to subcommand flags (#635)
  • 49b8029 fix: allow config to override invalid defaults (#633)
  • 28bd9c7 chore(deps): update actions/setup-go action to v7 (#632)
  • 598f0c8 Return an error instead of panicking on a map with an unmappable key/value ty...
  • 17807cf Fix panic on a set tag without a value (#623)
  • 27d969c fix: Call hooks from unexported embedded fields (#620)
  • 4e565e8 feat: Support negatable bool mappers (#618)
  • Additional commits viewable in compare view

Updates github.com/charmbracelet/x/ansi from 0.11.8 to 0.11.9

Commits
  • faa4adf ansi/v0.11.9
  • 09f7503 feat(ansi): OSC 7501 (#1004)
  • ad85c59 chore(powernap): update lsp configs from nvim-lspconfig
  • 953920d nerdfont/v0.1.0
  • 4edfc00 feat(nerdfont): overrides (#1000)
  • 7be62f4 chore(deps): bump golang.org/x/sys in /term in the all group (#996)
  • 29bfdbd feat: nerdfont
  • 9c77d67 chore(powernap): update lsp configs from nvim-lspconfig
  • d676b01 v0.1.0 for charmtone and slices
  • 53e2afe chore(powernap): update lsp configs from nvim-lspconfig
  • Additional commits viewable in compare view

Updates github.com/containerd/containerd/v2 from 2.4.1 to 2.4.2

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.4.2

Welcome to the v2.4.2 release of containerd!

The second patch release for containerd 2.4 contains various fixes and updates including security patches.

Security Updates

Highlights

Container Runtime Interface (CRI)

  • Apply hardening to not follow symlinks for container log files (#14302)

Image Distribution

  • Fix excessive memory usage during image pulls when registry downloads outpace content writes (#14342)
  • Apply hardening to reject image references with ".." path components (#14282)

Runtime

  • Apply hardening to allowlist socket domains in the default seccomp profile (#14247)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Samuel Karp
  • Maksym Pavlenko
  • Sebastiaan van Stijn
  • Derek McGowan
  • LEI WANG
  • Paweł Gronowski
  • Phil Estes
  • Wei Fu
  • syed abdul khaliq

Changes

  • 4b342aeaf Prepare release notes for v2.4.2
  • Update to go1.26.9 / go1.27.2 (security) (#14350)

... (truncated)

Commits
  • b7a2526 Merge pull request #14338 from samuelkarp/prepare-release-2.4.2
  • 4b342ae Prepare release notes for v2.4.2
  • b5811e5 Merge pull request #14350 from thaJeztah/2.4_bump_go
  • 1d734f7 Merge pull request #14347 from k8s-infra-cherrypick-robot/cherry-pick-14346-t...
  • 9c06c81 Update to go1.26.9 / go1.27.2
  • 187caba Merge commit from fork
  • fc7adbf Merge commit from fork
  • 39cff48 Merge commit from fork
  • 3fb9faa ci: update to golangci-lint v2.14.0 (go1.27.2 compatibility)
  • 44fd201 remotes/docker: bound parallel fetch readers
  • Additional commits viewable in compare view

Updates github.com/docker/cli from 29.8.1+incompatible to 29.9.2+incompatible

Commits
  • a82e528 Merge pull request #7418 from vvoland/7417-29.x
  • e35bc1b Update to go1.26.10
  • baf6c13 Bump version
  • 4051f75 Merge tag 'v29.9.1' into 7417-29.x
  • 76321a6 Merge tag 'v29.9.0' into 7417-29.x
  • b82456c Merge tag 'v29.8.2' into 7417-29.x
  • a98becc Bump version
  • dfc520d Merge pull request #7390 from renovate-bot/renovate/go-1.x
  • a3a2bb6 chore(deps): update dependency go to v1.27.1
  • c11295a Merge pull request #7388 from renovate-bot/renovate/tonistiigi-xx-1.x
  • Additional commits viewable in compare view

Updates github.com/jotaen/kong-completion from 0.0.14 to 0.0.15

Release notes

Sourced from github.com/jotaen/kong-completion's releases.

v0.0.15

What's Changed

Full Changelog: jotaen/kong-completion@v0.0.14...v0.0.15

Commits

Updates github.com/moby/buildkit from 0.31.1 to 0.34.2

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.34.2

Welcome to the v0.34.2 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • CrazyMax
  • Sebastiaan van Stijn
  • Tõnis Tiigi

Notable Changes

  • Fix a daemon panic caused by resolver cache poisoning when a build resolves metadata for the same Git source reference twice. GHSA-2fqp-xg6f-v7gj
  • Prevent malicious clients with access to the BuildKit control APIs from setting extended attributes on files outside the BuildKit state directory, potentially granting elevated privileges to programs on the host. GHSA-w26x-xg27-7qjc

Dependency Changes

  • github.com/containerd/containerd/v2 v2.4.1 -> v2.4.2
  • github.com/klauspost/compress v1.20.1 -> v1.20.2
  • github.com/tonistiigi/fsutil 83cac42c1c52 -> a72de9dcf763

Previous release can be found at v0.34.1

v0.34.1

buildkit 0.34.1

Welcome to the v0.34.1 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Security

This release has been built with updated Go runtime 1.26.10 to address CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected registries need a replacement certificate chain that does not use these intermediates.

The blocked intermediates are:

  • Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C
  • Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C
  • Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C
  • Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C

... (truncated)

Commits
  • 8c57943 Merge pull request #7357 from crazy-max/v0.34_picks_v0.34.2
  • 190c6bb ci: pin runj package for freebsd tests
  • 3d80d2d ci: migrate vagrant to vmactions
  • 6558374 vendor: github.com/containerd/containerd/v2 v2.4.2
  • 90bfd2f util/contentutil: remove uses of "-1" sentinel value for sizes
  • a49020b vendor: github.com/klauspost/compress v1.20.2
  • 16c6856 source/git: fix daemon panic on resolver cache poisoning
  • d4bfe06 vendor: update fsutil to a72de9dcf763
  • f5b59a1 Merge pull request #7257 from crazy-max/v0.34_pick_0.34.0
  • 0505d9f flightcontrol: fix the progress cleanup race.
  • Additional commits viewable in compare view

Updates github.com/posthog/posthog-go from 1.27.0 to 1.39.0

Release notes

Sourced from github.com/posthog/posthog-go's releases.

1.39.0

Unreleased

1.38.0

Unreleased

1.37.0

Unreleased

1.36.2

Unreleased

1.36.1

Unreleased

1.36.0

Unreleased

1.35.3

Unreleased

1.35.2

Unreleased

1.35.1

Unreleased

1.35.0

Unreleased

1.34.0

Unreleased

1.33.0

Unreleased

1.32.0

Unreleased

1.31.0

Unreleased

1.30.0

Unreleased

1.29.0

Unreleased

1.28.1

Unreleased

... (truncated)

Changelog

Sourced from github.com/posthog/posthog-go's changelog.

1.39.0

Minor Changes

  • 401e68f: Report flags that local evaluation could not resolve on EvaluateFlags snapshots. FeatureFlagEvaluations.UnresolvedFlags() maps each such flag to an UnresolvedFlagReason (experience_continuity, unsupported_definition, unresolved_dependency or missing_context), and InconclusiveMatchError and RequiresServerEvaluationError carry the reason in a new Reason field. When definitions load, log one warning per flag that local evaluation can never resolve (experience continuity, a static cohort, an unknown operator, a malformed value, or a missing or circular flag dependency), and again only when its definition changes.

    Behavior changes:

    • A condition with a filter that local evaluation can't check and a filter that does not match now resolves locally as no match. Before, such a flag fell back to a remote request, or stayed unresolved with OnlyEvaluateLocally.
    • An inactive flag with experience continuity enabled now resolves to false locally instead of falling back to a remote request.
    • $feature_flag_called events from snapshot reads of these flags report local_evaluation_inconclusive instead of flag_missing.
    • The load-time warning is logged with Logger.Warnf, so it shows without debug logging.

1.38.0

Minor Changes

  • 94ff576: Add an optional OpenTelemetry context processor and HTTP middleware for session and person IDs on application spans. Both take the PostHog client and add no IDs when that client is nil, disabled, or closed.

1.37.0

Minor Changes

  • 729bcf7: Add an opt-in OpenTelemetry enqueue helper that adds active trace and span IDs to exception events.

1.36.2

Patch Changes

  • e8c7d37: Fall back to remote feature flag evaluation for regex syntax and character-class semantics that cannot be evaluated consistently with the flags service, including through negated cohorts.

1.36.1

Patch Changes

  • 6b734dd: Preserve captured events with non-finite numeric properties by serializing NaN and infinities as null in both capture protocols. Arbitrary structs containing these numbers are replaced with null as a whole property.

1.36.0

Minor Changes

  • d170fc5: Local flag evaluation honors experiment holdouts. A flag whose definition carries filters.holdout now resolves a held-out identifier to holdout-<id> before its release conditions, matching the server instead of silently bucketing the identifier into a regular variant.

1.35.3

Patch Changes

  • 870af8a: Fix local feature flag string and regex operators to stringify explicit null values as "null", matching the flags service. Flag results and variant selection can change for explicit-null properties; missing properties remain inconclusive and eligible for remote evaluation.

1.35.2

... (truncated)

Commits
  • e13d11c chore: release v1.39.0 [version bump] [skip ci]
  • 401e68f feat(flags): report unresolved local flags on EvaluateFlags snapshots (#396)
  • b0a9fae chore: release v1.38.0 [version bump] [skip ci]
  • 94ff576 feat(otel): add request context to application spans (#375)
  • 5d73532 chore: release v1.37.0 [version bump] [skip ci]
  • 729bcf7 feat(otel): add opt-in exception trace context (#374)
  • 32f2522 chore: release v1.36.2 [version bump] [skip ci]
  • e8c7d37 fix(flags): fall back for incompatible local regex evaluation (#387)
  • 56aa91d docs: require signed commits in contributor docs (#388)
  • aef332c chore: release v1.36.1 [version bump] [skip ci]
  • Additional commits viewable in compare view

Updates github.com/tidwall/gjson from 1.19.0 to 1.20.0

Commits
  • 690362d Deprecate DisableModifiers and DisableEscapeHTML globals
  • b91555e nl at 80
  • b603eb1 Cleanup and modernize
  • 9378d3b Fix Result.Path panics
  • 8d89927 Ensure floating points are correctly being clipped
  • eaae8c6 Fix large number overflows for Int() and Uint()
  • 6ac9851 Change utf8 behavior for invalid codepoints
  • 5fc5c04 Update README.md
  • 7d8b382 Update README.md
  • 896d569 Update gjson.go
  • Additional commits viewable in compare view

Updates github.com/tonistiigi/fsutil from 0.0.0-20260819142231-83cac42c1c52 to 0.0.0-20261103091533-a72de9dcf763

Commits

Updates golang.org/x/mod from 0.41.0 to 0.42.0

Commits
  • b5136e5 sumdb/tlog: use recorded responses in TestCertificateTransparency
  • 1e9a5ae go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/sync from 0.23.0 to 0.24.0

Commits
  • 36f2d70 errgroup: modernize the usage of closures in goroutines
  • See full diff in compare view

Updates golang.org/x/text from 0.42.0 to 0.43.0

Commits
  • ac40b0f go.mod: update golang.org/x dependencies
  • 6dcc5b6 unicode/bidi: avoid quadratic behavior in Paragraph.Order and Paragraph.Line
  • d0ecd29 secure/bidirule: lazily precompute ASCII table
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 6, 2026
@dependabot
gomod(deps): Bump the go-deps group across 1 directory with 13 updates
55cc08b 
Bumps the go-deps group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| charm.land/bubbletea/v2 | `2.0.10` | `2.1.1` |
| [github.com/alecthomas/kong](https://github.com/alecthomas/kong) | `1.16.1` | `1.17.0` |
| [github.com/charmbracelet/x/ansi](https://github.com/charmbracelet/x) | `0.11.8` | `0.11.9` |
| [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) | `2.4.1` | `2.4.2` |
| [github.com/docker/cli](https://github.com/docker/cli) | `29.8.1+incompatible` | `29.9.2+incompatible` |
| [github.com/jotaen/kong-completion](https://github.com/jotaen/kong-completion) | `0.0.14` | `0.0.15` |
| [github.com/moby/buildkit](https://github.com/moby/buildkit) | `0.31.1` | `0.34.2` |
| [github.com/posthog/posthog-go](https://github.com/posthog/posthog-go) | `1.27.0` | `1.39.0` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.19.0` | `1.20.0` |
| [github.com/tonistiigi/fsutil](https://github.com/tonistiigi/fsutil) | `0.0.0-20260819142231-83cac42c1c52` | `0.0.0-20261103091533-a72de9dcf763` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.41.0` | `0.42.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.23.0` | `0.24.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.42.0` | `0.43.0` |



Updates `charm.land/bubbletea/v2` from 2.0.10 to 2.1.1

Updates `github.com/alecthomas/kong` from 1.16.1 to 1.17.0
- [Commits](alecthomas/kong@v1.16.1...v1.17.0)

Updates `github.com/charmbracelet/x/ansi` from 0.11.8 to 0.11.9
- [Commits](charmbracelet/x@ansi/v0.11.8...ansi/v0.11.9)

Updates `github.com/containerd/containerd/v2` from 2.4.1 to 2.4.2
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v2.4.1...v2.4.2)

Updates `github.com/docker/cli` from 29.8.1+incompatible to 29.9.2+incompatible
- [Commits](docker/cli@v29.8.1...v29.9.2)

Updates `github.com/jotaen/kong-completion` from 0.0.14 to 0.0.15
- [Release notes](https://github.com/jotaen/kong-completion/releases)
- [Commits](jotaen/kong-completion@v0.0.14...v0.0.15)

Updates `github.com/moby/buildkit` from 0.31.1 to 0.34.2
- [Release notes](https://github.com/moby/buildkit/releases)
- [Commits](moby/buildkit@v0.31.1...v0.34.2)

Updates `github.com/posthog/posthog-go` from 1.27.0 to 1.39.0
- [Release notes](https://github.com/posthog/posthog-go/releases)
- [Changelog](https://github.com/PostHog/posthog-go/blob/main/CHANGELOG.md)
- [Commits](PostHog/posthog-go@v1.27.0...v1.39.0)

Updates `github.com/tidwall/gjson` from 1.19.0 to 1.20.0
- [Commits](tidwall/gjson@v1.19.0...v1.20.0)

Updates `github.com/tonistiigi/fsutil` from 0.0.0-20260819142231-83cac42c1c52 to 0.0.0-20261103091533-a72de9dcf763
- [Commits](https://github.com/tonistiigi/fsutil/commits)

Updates `golang.org/x/mod` from 0.41.0 to 0.42.0
- [Commits](golang/mod@v0.41.0...v0.42.0)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](golang/sync@v0.23.0...v0.24.0)

Updates `golang.org/x/text` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.42.0...v0.43.0)

---
updated-dependencies:
- dependency-name: charm.land/bubbletea/v2
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/alecthomas/kong
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/charmbracelet/x/ansi
  dependency-version: 0.11.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/containerd/containerd/v2
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/docker/cli
  dependency-version: 29.9.2+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/jotaen/kong-completion
  dependency-version: 0.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/moby/buildkit
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/posthog/posthog-go
  dependency-version: 1.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/tidwall/gjson
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/tonistiigi/fsutil
  dependency-version: 0.0.0-20261103091533-a72de9dcf763
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: golang.org/x/mod
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/text
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/prod-staging/go-deps-b25bf7086a branch from 396cc0b to 55cc08b Compare November 6, 2026 13:56
@dependabot @github

dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 8, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/prod-staging/go-deps-b25bf7086a branch November 8, 2026 09:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants