Skip to content

gomod(deps): Bump the go-deps group across 1 directory with 14 updates - #608

Open
dependabot[bot] wants to merge 1 commit into
prod-stagingfrom
dependabot/go_modules/prod-staging/go-deps-124cdf03ab
Open

gomod(deps): Bump the go-deps group across 1 directory with 14 updates#608
dependabot[bot] wants to merge 1 commit into
prod-stagingfrom
dependabot/go_modules/prod-staging/go-deps-124cdf03ab

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 14 updates in the / directory:

Package From To
charm.land/bubbletea/v2 2.0.10 2.1.1
github.com/alecthomas/kong 1.16.1 1.17.0
github.com/charmbracelet/x/ansi 0.11.8 0.11.9
github.com/containerd/containerd/v2 2.4.1 2.4.2
github.com/docker/cli 29.8.1+incompatible 29.9.3+incompatible
github.com/go-json-experiment/json 0.0.0-20260623181947-01eb4420fa68 1.27.0
github.com/jotaen/kong-completion 0.0.14 0.0.15
github.com/moby/buildkit 0.31.1 0.34.2
github.com/posthog/posthog-go 1.27.0 1.39.0
github.com/tidwall/gjson 1.19.0 1.20.0
github.com/tonistiigi/fsutil 0.0.0-20260819142231-83cac42c1c52 0.0.0-20261103091533-a72de9dcf763
golang.org/x/mod 0.41.0 0.42.0
golang.org/x/sync 0.23.0 0.24.0
golang.org/x/text 0.42.0 0.43.0

Updates charm.land/bubbletea/v2 from 2.0.10 to 2.1.1
Updates github.com/alecthomas/kong from 1.16.1 to 1.17.0

Commits
  • af6c651 fix: reject default command flags before a sibling command (#679)
  • 24be2f9 fix: allow empty fallback in variable interpolation
  • a60008c Add last-wins flag groups (#653)
  • b778e12 Propagate envprefix to subcommand flags (#635)
  • 49b8029 fix: allow config to override invalid defaults (#633)
  • 28bd9c7 chore(deps): update actions/setup-go action to v7 (#632)
  • 598f0c8 Return an error instead of panicking on a map with an unmappable key/value ty...
  • 17807cf Fix panic on a set tag without a value (#623)
  • 27d969c fix: Call hooks from unexported embedded fields (#620)
  • 4e565e8 feat: Support negatable bool mappers (#618)
  • Additional commits viewable in compare view

Updates github.com/charmbracelet/x/ansi from 0.11.8 to 0.11.9

Commits
  • faa4adf ansi/v0.11.9
  • 09f7503 feat(ansi): OSC 7501 (#1004)
  • ad85c59 chore(powernap): update lsp configs from nvim-lspconfig
  • 953920d nerdfont/v0.1.0
  • 4edfc00 feat(nerdfont): overrides (#1000)
  • 7be62f4 chore(deps): bump golang.org/x/sys in /term in the all group (#996)
  • 29bfdbd feat: nerdfont
  • 9c77d67 chore(powernap): update lsp configs from nvim-lspconfig
  • d676b01 v0.1.0 for charmtone and slices
  • 53e2afe chore(powernap): update lsp configs from nvim-lspconfig
  • Additional commits viewable in compare view

Updates github.com/containerd/containerd/v2 from 2.4.1 to 2.4.2

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.4.2

Welcome to the v2.4.2 release of containerd!

The second patch release for containerd 2.4 contains various fixes and updates including security patches.

Security Updates

Highlights

Container Runtime Interface (CRI)

  • Apply hardening to not follow symlinks for container log files (#14302)

Image Distribution

  • Fix excessive memory usage during image pulls when registry downloads outpace content writes (#14342)
  • Apply hardening to reject image references with ".." path components (#14282)

Runtime

  • Apply hardening to allowlist socket domains in the default seccomp profile (#14247)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Samuel Karp
  • Maksym Pavlenko
  • Sebastiaan van Stijn
  • Derek McGowan
  • LEI WANG
  • Paweł Gronowski
  • Phil Estes
  • Wei Fu
  • syed abdul khaliq

Changes

  • 4b342aeaf Prepare release notes for v2.4.2
  • Update to go1.26.9 / go1.27.2 (security) (#14350)

... (truncated)

Commits
  • b7a2526 Merge pull request #14338 from samuelkarp/prepare-release-2.4.2
  • 4b342ae Prepare release notes for v2.4.2
  • b5811e5 Merge pull request #14350 from thaJeztah/2.4_bump_go
  • 1d734f7 Merge pull request #14347 from k8s-infra-cherrypick-robot/cherry-pick-14346-t...
  • 9c06c81 Update to go1.26.9 / go1.27.2
  • 187caba Merge commit from fork
  • fc7adbf Merge commit from fork
  • 39cff48 Merge commit from fork
  • 3fb9faa ci: update to golangci-lint v2.14.0 (go1.27.2 compatibility)
  • 44fd201 remotes/docker: bound parallel fetch readers
  • Additional commits viewable in compare view

Updates github.com/docker/cli from 29.8.1+incompatible to 29.9.3+incompatible

Commits
  • 5457199 Merge pull request #7470 from thaJeztah/29.x_backport_bump_compress
  • cac50c5 vendor: github.com/klauspost/compress v1.20.2
  • 00d843b Merge pull request #7467 from thaJeztah/29.x_backport_bump_swarmkit
  • 64fe50b vendor: github.com/moby/swarmkit/v2 v2.1.3
  • 999ab16 Merge pull request #7464 from thaJeztah/29.x_backport_bump_jose2
  • bb485bc vendor: github.com/go-jose/go-jose/v4 v4.1.7
  • 86e51b4 Merge pull request #7461 from thaJeztah/29.x_backport_bump_yaml
  • d9bbcfc Merge pull request #7457 from thaJeztah/29.x_backport_bump_jose
  • 2e88626 Merge pull request #7458 from thaJeztah/29.x_bump_version
  • a4971d1 vendor: go.yaml.in/yaml/v3 v3.0.6
  • Additional commits viewable in compare view

Updates github.com/go-json-experiment/json from 0.0.0-20260623181947-01eb4420fa68 to 1.27.0

Commits

Updates github.com/jotaen/kong-completion from 0.0.14 to 0.0.15

Release notes

Sourced from github.com/jotaen/kong-completion's releases.

v0.0.15

What's Changed

Full Changelog: jotaen/kong-completion@v0.0.14...v0.0.15

Commits

Updates github.com/moby/buildkit from 0.31.1 to 0.34.2

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.34.2

Welcome to the v0.34.2 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • CrazyMax
  • Sebastiaan van Stijn
  • Tõnis Tiigi

Notable Changes

  • Fix a daemon panic caused by resolver cache poisoning when a build resolves metadata for the same Git source reference twice. GHSA-2fqp-xg6f-v7gj
  • Prevent malicious clients with access to the BuildKit control APIs from setting extended attributes on files outside the BuildKit state directory, potentially granting elevated privileges to programs on the host. GHSA-w26x-xg27-7qjc

Dependency Changes

  • github.com/containerd/containerd/v2 v2.4.1 -> v2.4.2
  • github.com/klauspost/compress v1.20.1 -> v1.20.2
  • github.com/tonistiigi/fsutil 83cac42c1c52 -> a72de9dcf763

Previous release can be found at v0.34.1

v0.34.1

buildkit 0.34.1

Welcome to the v0.34.1 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Security

This release has been built with updated Go runtime 1.26.10 to address CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected registries need a replacement certificate chain that does not use these intermediates.

The blocked intermediates are:

  • Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C
  • Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C
  • Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C
  • Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C

... (truncated)

Commits
  • 8c57943 Merge pull request #7357 from crazy-max/v0.34_picks_v0.34.2
  • 190c6bb ci: pin runj package for freebsd tests
  • 3d80d2d ci: migrate vagrant to vmactions
  • 6558374 vendor: github.com/containerd/containerd/v2 v2.4.2
  • 90bfd2f util/contentutil: remove uses of "-1" sentinel value for sizes
  • a49020b vendor: github.com/klauspost/compress v1.20.2
  • 16c6856 source/git: fix daemon panic on resolver cache poisoning
  • d4bfe06 vendor: update fsutil to a72de9dcf763
  • f5b59a1 Merge pull request #7257 from crazy-max/v0.34_pick_0.34.0
  • 0505d9f flightcontrol: fix the progress cleanup race.
  • Additional commits viewable in compare view

Updates github.com/posthog/posthog-go from 1.27.0 to 1.39.0

Release notes

Sourced from github.com/posthog/posthog-go's releases.

1.39.0

Unreleased

1.38.0

Unreleased

1.37.0

Unreleased

1.36.2

Unreleased

1.36.1

Unreleased

1.36.0

Unreleased

1.35.3

Unreleased

1.35.2

Unreleased

1.35.1

Unreleased

1.35.0

Unreleased

1.34.0

Unreleased

1.33.0

Unreleased

1.32.0

Unreleased

1.31.0

Unreleased

1.30.0

Unreleased

1.29.0

Unreleased

1.28.1

Unreleased

... (truncated)

Changelog

Sourced from github.com/posthog/posthog-go's changelog.

1.39.0

Minor Changes

  • 401e68f: Report flags that local evaluation could not resolve on EvaluateFlags snapshots. FeatureFlagEvaluations.UnresolvedFlags() maps each such flag to an UnresolvedFlagReason (experience_continuity, unsupported_definition, unresolved_dependency or missing_context), and InconclusiveMatchError and RequiresServerEvaluationError carry the reason in a new Reason field. When definitions load, log one warning per flag that local evaluation can never resolve (experience continuity, a static cohort, an unknown operator, a malformed value, or a missing or circular flag dependency), and again only when its definition changes.

    Behavior changes:

    • A condition with a filter that local evaluation can't check and a filter that does not match now resolves locally as no match. Before, such a flag fell back to a remote request, or stayed unresolved with OnlyEvaluateLocally.
    • An inactive flag with experience continuity enabled now resolves to false locally instead of falling back to a remote request.
    • $feature_flag_called events from snapshot reads of these flags report local_evaluation_inconclusive instead of flag_missing.
    • The load-time warning is logged with Logger.Warnf, so it shows without debug logging.

1.38.0

Minor Changes

  • 94ff576: Add an optional OpenTelemetry context processor and HTTP middleware for session and person IDs on application spans. Both take the PostHog client and add no IDs when that client is nil, disabled, or closed.

1.37.0

Minor Changes

  • 729bcf7: Add an opt-in OpenTelemetry enqueue helper that adds active trace and span IDs to exception events.

1.36.2

Patch Changes

  • e8c7d37: Fall back to remote feature flag evaluation for regex syntax and character-class semantics that cannot be evaluated consistently with the flags service, including through negated cohorts.

1.36.1

Patch Changes

  • 6b734dd: Preserve captured events with non-finite numeric properties by serializing NaN and infinities as null in both capture protocols. Arbitrary structs containing these numbers are replaced with null as a whole property.

1.36.0

Minor Changes

  • d170fc5: Local flag evaluation honors experiment holdouts. A flag whose definition carries filters.holdout now resolves a held-out identifier to holdout-<id> before its release conditions, matching the server instead of silently bucketing the identifier into a regular variant.

1.35.3

Patch Changes

  • 870af8a: Fix local feature flag string and regex operators to stringify explicit null values as "null", matching the flags service. Flag results and variant selection can change for explicit-null properties; missing properties remain inconclusive and eligible for remote evaluation.

1.35.2

... (truncated)

Commits
  • e13d11c chore: release v1.39.0 [version bump] [skip ci]
  • 401e68f feat(flags): report unresolved local flags on EvaluateFlags snapshots (#396)
  • b0a9fae chore: release v1.38.0 [version bump] [skip ci]
  • 94ff576 feat(otel): add request context to application spans (#375)
  • 5d73532 chore: release v1.37.0 [version bump] [skip ci]
  • 729bcf7 feat(otel): add opt-in exception trace context (#374)
  • 32f2522 chore: release v1.36.2 [version bump] [skip ci]
  • e8c7d37 fix(flags): fall back for incompatible local regex evaluation (#387)
  • 56aa91d docs: require signed commits in contributor docs (#388)
  • aef332c chore: release v1.36.1 [version bump] [skip ci]
  • Additional commits viewable in compare view

Updates github.com/tidwall/gjson from 1.19.0 to 1.20.0

Commits
  • 690362d Deprecate DisableModifiers and DisableEscapeHTML globals
  • b91555e nl at 80
  • b603eb1 Cleanup and modernize
  • 9378d3b Fix Result.Path panics
  • 8d89927 Ensure floating points are correctly being clipped
  • eaae8c6 Fix large number overflows for Int() and Uint()
  • 6ac9851 Change utf8 behavior for invalid codepoints
  • 5fc5c04 Update README.md
  • 7d8b382 Update README.md
  • 896d569 Update gjson.go
  • Additional commits viewable in compare view

Updates github.com/tonistiigi/fsutil from 0.0.0-20260819142231-83cac42c1c52 to 0.0.0-20261103091533-a72de9dcf763

Commits

Updates golang.org/x/mod from 0.41.0 to 0.42.0

Commits
  • b5136e5 sumdb/tlog: use recorded responses in TestCertificateTransparency
  • 1e9a5ae go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/sync from 0.23.0 to 0.24.0

Commits
  • 36f2d70 errgroup: modernize the usage of closures in goroutines
  • See full diff in compare view

Updates golang.org/x/text from 0.42.0 to 0.43.0

Commits
  • ac40b0f go.mod: update golang.org/x dependencies
  • 6dcc5b6 unicode/bidi: avoid quadratic behavior in Paragraph.Order and Paragraph.Line
  • d0ecd29 secure/bidirule: lazily precompute ASCII table
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
gomod(deps): Bump the go-deps group across 1 directory with 14 updates
79a7cc4 
Bumps the go-deps group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| charm.land/bubbletea/v2 | `2.0.10` | `2.1.1` |
| [github.com/alecthomas/kong](https://github.com/alecthomas/kong) | `1.16.1` | `1.17.0` |
| [github.com/charmbracelet/x/ansi](https://github.com/charmbracelet/x) | `0.11.8` | `0.11.9` |
| [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) | `2.4.1` | `2.4.2` |
| [github.com/docker/cli](https://github.com/docker/cli) | `29.8.1+incompatible` | `29.9.3+incompatible` |
| [github.com/go-json-experiment/json](https://github.com/go-json-experiment/json) | `0.0.0-20260623181947-01eb4420fa68` | `1.27.0` |
| [github.com/jotaen/kong-completion](https://github.com/jotaen/kong-completion) | `0.0.14` | `0.0.15` |
| [github.com/moby/buildkit](https://github.com/moby/buildkit) | `0.31.1` | `0.34.2` |
| [github.com/posthog/posthog-go](https://github.com/posthog/posthog-go) | `1.27.0` | `1.39.0` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.19.0` | `1.20.0` |
| [github.com/tonistiigi/fsutil](https://github.com/tonistiigi/fsutil) | `0.0.0-20260819142231-83cac42c1c52` | `0.0.0-20261103091533-a72de9dcf763` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.41.0` | `0.42.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.23.0` | `0.24.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.42.0` | `0.43.0` |



Updates `charm.land/bubbletea/v2` from 2.0.10 to 2.1.1

Updates `github.com/alecthomas/kong` from 1.16.1 to 1.17.0
- [Commits](alecthomas/kong@v1.16.1...v1.17.0)

Updates `github.com/charmbracelet/x/ansi` from 0.11.8 to 0.11.9
- [Commits](charmbracelet/x@ansi/v0.11.8...ansi/v0.11.9)

Updates `github.com/containerd/containerd/v2` from 2.4.1 to 2.4.2
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v2.4.1...v2.4.2)

Updates `github.com/docker/cli` from 29.8.1+incompatible to 29.9.3+incompatible
- [Commits](docker/cli@v29.8.1...v29.9.3)

Updates `github.com/go-json-experiment/json` from 0.0.0-20260623181947-01eb4420fa68 to 1.27.0
- [Commits](https://github.com/go-json-experiment/json/commits/v1.27.0)

Updates `github.com/jotaen/kong-completion` from 0.0.14 to 0.0.15
- [Release notes](https://github.com/jotaen/kong-completion/releases)
- [Commits](jotaen/kong-completion@v0.0.14...v0.0.15)

Updates `github.com/moby/buildkit` from 0.31.1 to 0.34.2
- [Release notes](https://github.com/moby/buildkit/releases)
- [Commits](moby/buildkit@v0.31.1...v0.34.2)

Updates `github.com/posthog/posthog-go` from 1.27.0 to 1.39.0
- [Release notes](https://github.com/posthog/posthog-go/releases)
- [Changelog](https://github.com/PostHog/posthog-go/blob/main/CHANGELOG.md)
- [Commits](PostHog/posthog-go@v1.27.0...v1.39.0)

Updates `github.com/tidwall/gjson` from 1.19.0 to 1.20.0
- [Commits](tidwall/gjson@v1.19.0...v1.20.0)

Updates `github.com/tonistiigi/fsutil` from 0.0.0-20260819142231-83cac42c1c52 to 0.0.0-20261103091533-a72de9dcf763
- [Commits](https://github.com/tonistiigi/fsutil/commits)

Updates `golang.org/x/mod` from 0.41.0 to 0.42.0
- [Commits](golang/mod@v0.41.0...v0.42.0)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](golang/sync@v0.23.0...v0.24.0)

Updates `golang.org/x/text` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.42.0...v0.43.0)

---
updated-dependencies:
- dependency-name: charm.land/bubbletea/v2
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/alecthomas/kong
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/charmbracelet/x/ansi
  dependency-version: 0.11.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/containerd/containerd/v2
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/docker/cli
  dependency-version: 29.9.3+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/go-json-experiment/json
  dependency-version: 1.27.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: go-deps
- dependency-name: github.com/jotaen/kong-completion
  dependency-version: 0.0.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/moby/buildkit
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/posthog/posthog-go
  dependency-version: 1.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/tidwall/gjson
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/tonistiigi/fsutil
  dependency-version: 0.0.0-20261103091533-a72de9dcf763
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: golang.org/x/mod
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/text
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants