Skip to content

chore(deps): bump the go-minor group with 6 updates #5369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the go-minor group with 6 updates #5369

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 9, 2025

Bumps the go-minor group with 6 updates:

Package From To
github.com/Azure/azure-sdk-for-go/sdk/azcore 1.19.1 1.20.0
github.com/cyphar/filepath-securejoin 0.5.1 0.6.0
gitlab.com/gitlab-org/api/client-go 0.157.1 0.159.0
golang.org/x/oauth2 0.32.0 0.33.0
golang.org/x/sync 0.17.0 0.18.0
google.golang.org/api 0.254.0 0.255.0

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.19.1 to 1.20.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.20.0

1.20.0 (2025-11-06)

Features Added

  • Added runtime.FetcherForNextLinkOptions.HTTPVerb to specify the HTTP verb when fetching the next page via next link. Defaults to http.MethodGet.

Bugs Fixed

  • Fixed potential panic when decoding base64 strings.
  • Fixed an issue in resource identifier parsing which prevented it from returning an error for malformed resource IDs.
Commits
  • 466795e Prep [email protected] (#25563)
  • 6fce238 [azsystemevents] Remove gopls (#25555)
  • c0ac8ea Sync eng/common directory with azure-sdk-tools for PR 12476 (#25549)
  • 047fb66 [Release] sdk/resourcemanager/containerregistry/armcontainerregistry/2.0.0 (#...
  • 908cfea [azsystemevents] Fixing build.go to work properly with tsp-client as the orch...
  • c30fd4c cosmos: Allow the Query Pipeline to return an alternative query to execute in...
  • 1b44564 fixed resource type validation in ParseResourceType and correlated tests (#25...
  • e566eec Sync eng/common directory with azure-sdk-tools for PR 12531 (#25545)
  • 053de1a Increment package version after release of data/azcosmos (#25544)
  • 8e673bb release pr (#25543)
  • Additional commits viewable in compare view

Updates github.com/cyphar/filepath-securejoin from 0.5.1 to 0.6.0

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.6.0 -- "By the Power of Greyskull!"

While quite small code-wise, this release marks a very key point in the development of filepath-securejoin.

filepath-securejoin was originally intended (back in 2017) to simply be a single-purpose library that would take some common code used in container runtimes (specifically, Docker's FollowSymlinksInScope) and make it more general-purpose (with the eventual goals of it ending up in the Go stdlib).

Of course, I quickly discovered that this problem was actually far more complicated to solve when dealing with racing attackers, which lead to me developing openat2(2) and libpathrs. I had originally planned for libpathrs to completely replace filepath-securejoin "once it was ready" but in the interim we needed to fix several race attacks in runc as part of security advisories. Obviously we couldn't require the usage of a pre-0.1 Rust library in runc so it was necessary to port bits of libpathrs into filepath-securejoin. (Ironically the first prototypes of libpathrs were originally written in Go and then rewritten to Rust, so the code in filepath-securejoin is actually Go code that was rewritten to Rust then re-rewritten to Go.)

It then became clear that pure-Go libraries will likely not be willing to require CGo for all of their builds, so it was necessary to accept that filepath-securejoin will need to stay. As such, in v0.5.0 we provided more pure-Go implementations of features from libpathrs but moved them into pathrs-lite subpackage to clarify what purpose these helpers serve.

This release finally closes the loop and makes it so that pathrs-lite can transparently use libpathrs (via a libpathrs build-tag). This means that upstream libraries can use the pure Go version if they prefer, but downstreams (either downstream library users or even downstream distributions) are able to migrate to libpathrs for all usages of pathrs-lite in an entire Go binary.

I should make it clear that I do not plan to port the rest of libpathrs to Go, as I do not wish to maintain two copies of the same codebase. pathrs-lite already provides the core essentials necessary to operate on paths safely for most modern systems. Users who want additional hardening or more ergonomic APIs are free to use cyphar.com/go-pathrs (libpathrs's Go bindings).

Breaking

  • The deprecated MkdirAll, MkdirAllHandle, OpenInRoot, OpenatInRoot and Reopen wrappers have been removed. Please switch to using pathrs-lite directly.

Added

  • pathrs-lite now has support for using libpathrs as a backend. This is opt-in and can be enabled at build time with the libpathrs build tag. The intention is to allow for downstream libraries and other projects to

... (truncated)

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.6.0] - 2025-11-03

By the Power of Greyskull!

Breaking

  • The deprecated MkdirAll, MkdirAllHandle, OpenInRoot, OpenatInRoot and Reopen wrappers have been removed. Please switch to using pathrs-lite directly.

Added

  • pathrs-lite now has support for using libpathrs as a backend. This is opt-in and can be enabled at build time with the libpathrs build tag. The intention is to allow for downstream libraries and other projects to make use of the pure-Go github.com/cyphar/filepath-securejoin/pathrs-lite package and distributors can then opt-in to using libpathrs for the entire binary if they wish.
Commits
  • 60da611 VERSION: release v0.6.0
  • f9f2d4c go: bump to cyphar.com/[email protected]
  • 9543130 merge v0.5.x branch into main
  • aa2152d merge #78 into cyphar/filepath-securejoin:release-0.5
  • d85ff0a VERSION: back to development
  • 8e20ab4 CHANGELOG: mention openat2 retry loop changes
  • cc741d0 merge #76 into cyphar/filepath-securejoin:main
  • 28c6340 openat2: increase retry count to 128
  • b840126 build(deps): bump actions/download-artifact from 5 to 6
  • 96c57dc Merge pull request #75 from cyphar/dependabot/github_actions/actions/upload-a...
  • Additional commits viewable in compare view

Updates gitlab.com/gitlab-org/api/client-go from 0.157.1 to 0.159.0

Release notes

Sourced from gitlab.com/gitlab-org/api/client-go's releases.

v0.159.0

0.159.0

🚀 Features

  • feat(integrations): add group integration API endpoints for Jira (!2563) by Harsh Rai

🔄 Other Changes

0.159.0 (2025-11-04)

Features

  • integrations: add group integration API endpoints for Jira (09e18ee)

v0.158.0

0.158.0

🚀 Features

  • Add support to send variables for GraphQL queries (!2562) by rafasf

🔄 Other Changes

0.158.0 (2025-11-03)

Changelog

Sourced from gitlab.com/gitlab-org/api/client-go's changelog.

0.159.0

🚀 Features

  • feat(integrations): add group integration API endpoints for Jira (!2563) by Harsh Rai

🔄 Other Changes

0.159.0 (2025-11-04)

Features

  • integrations: add group integration API endpoints for Jira (09e18ee)

0.158.0

🚀 Features

  • Add support to send variables for GraphQL queries (!2562) by rafasf

🔄 Other Changes

0.158.0 (2025-11-03)

Commits
  • 7f18968 chore(release): 0.159.0 [skip ci]
  • 261b865 Merge branch 'harsh/group-jira-endpoints' into 'main'
  • 09e18ee feat(integrations): add group integration API endpoints for Jira
  • 2c4ff59 Merge branch 'renovate/golangci-golangci-lint-2.x' into 'main'
  • 77f938d chore(deps): update golangci/golangci-lint docker tag to v2.6.1
  • a5af321 chore(release): 0.158.0 [skip ci]
  • 04971da Merge branch 'rafasf-graphqlvars' into 'main'
  • b489429 Add support to send variables for GraphQL queries
  • e1c803f Merge branch 'renovate/cel.dev-expr-0.x' into 'main'
  • 76ed254 Merge branch 'gitlab-naming' into 'main'
  • Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.32.0 to 0.33.0

Commits

Updates golang.org/x/sync from 0.17.0 to 0.18.0

Commits

Updates google.golang.org/api from 0.254.0 to 0.255.0

Release notes

Sourced from google.golang.org/api's releases.

v0.255.0

0.255.0 (2025-11-04)

Features

Changelog

Sourced from google.golang.org/api's changelog.

0.255.0 (2025-11-04)

Features

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the go-minor group with 6 updates
ecb435a 
Bumps the go-minor group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go) | `1.19.1` | `1.20.0` |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.5.1` | `0.6.0` |
| [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) | `0.157.1` | `0.159.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.32.0` | `0.33.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.17.0` | `0.18.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.254.0` | `0.255.0` |


Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.19.1 to 1.20.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.19.1...sdk/azcore/v1.20.0)

Updates `github.com/cyphar/filepath-securejoin` from 0.5.1 to 0.6.0
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.5.1...v0.6.0)

Updates `gitlab.com/gitlab-org/api/client-go` from 0.157.1 to 0.159.0
- [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags)
- [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md)
- [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v0.157.1...v0.159.0)

Updates `golang.org/x/oauth2` from 0.32.0 to 0.33.0
- [Commits](golang/oauth2@v0.32.0...v0.33.0)

Updates `golang.org/x/sync` from 0.17.0 to 0.18.0
- [Commits](golang/sync@v0.17.0...v0.18.0)

Updates `google.golang.org/api` from 0.254.0 to 0.255.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.254.0...v0.255.0)

---
updated-dependencies:
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azcore
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor
- dependency-name: gitlab.com/gitlab-org/api/client-go
  dependency-version: 0.159.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor
- dependency-name: golang.org/x/sync
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor
- dependency-name: google.golang.org/api
  dependency-version: 0.255.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file; mainly used by Dependabot go Pull requests that update Go code labels Nov 9, 2025
@dependabot dependabot bot requested a review from a team as a code owner November 9, 2025 05:07
@dependabot dependabot bot added dependencies Pull requests that update a dependency file; mainly used by Dependabot go Pull requests that update Go code labels Nov 9, 2025
@netlify
Copy link

netlify bot commented Nov 9, 2025 •
edited
Loading

✅ Deploy Preview for docs-kargo-io ready!

Name Link
🔨 Latest commit ecb435a
🔍 Latest deploy log https://app.netlify.com/projects/docs-kargo-io/deploys/691021af671b0d000844fc24
😎 Deploy Preview https://deploy-preview-5369.docs.kargo.io
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file; mainly used by Dependabot go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant