build(deps): bump the go_modules group across 4 directories with 3 updates

Open

Number: #100
Type: Pull Request
State: Open

Author:

dependabot[bot]
Association: Unknown
Comments: 6

Created: April 08, 2026 at 01:44 AM UTC
(2 months ago)

Updated: May 29, 2026 at 12:23 AM UTC
(14 days ago)

Labels:
dependencies go

Description:

Bumps the go_modules group with 1 update in the /examples/multi-engine-eventbus directory: github.com/aws/aws-sdk-go-v2/service/kinesis.
Bumps the go_modules group with 1 update in the /examples/nats-eventbus directory: github.com/aws/aws-sdk-go-v2/service/kinesis.
Bumps the go_modules group with 2 updates in the /modules/eventbus directory: github.com/aws/aws-sdk-go-v2/service/kinesis and github.com/nats-io/nats-server/v2.
Bumps the go_modules group with 1 update in the /modules/letsencrypt directory: github.com/go-jose/go-jose/v4.

Updates github.com/aws/aws-sdk-go-v2/service/kinesis from 1.38.0 to 1.43.5

Commits

f9f7a6b Release 2025-07-19
c74fb63 Regenerated Clients
d09b466 generate aws-eusc (#3144)
45575dd Release 2025-07-18
40f9e8b Regenerated Clients
da30009 Update endpoints model
78fe67f Update API model
654c62d Release 2025-07-17
47a74cd Regenerated Clients
bdd96b2 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/kinesis from 1.38.0 to 1.43.5

Commits

f9f7a6b Release 2025-07-19
c74fb63 Regenerated Clients
d09b466 generate aws-eusc (#3144)
45575dd Release 2025-07-18
40f9e8b Regenerated Clients
da30009 Update endpoints model
78fe67f Update API model
654c62d Release 2025-07-17
47a74cd Regenerated Clients
bdd96b2 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/kinesis from 1.38.0 to 1.43.5

Commits

f9f7a6b Release 2025-07-19
c74fb63 Regenerated Clients
d09b466 generate aws-eusc (#3144)
45575dd Release 2025-07-18
40f9e8b Regenerated Clients
da30009 Update endpoints model
78fe67f Update API model
654c62d Release 2025-07-17
47a74cd Regenerated Clients
bdd96b2 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/kinesis from 1.38.0 to 1.43.5

Commits

f9f7a6b Release 2025-07-19
c74fb63 Regenerated Clients
d09b466 generate aws-eusc (#3144)
45575dd Release 2025-07-18
40f9e8b Regenerated Clients
da30009 Update endpoints model
78fe67f Update API model
654c62d Release 2025-07-17
47a74cd Regenerated Clients
bdd96b2 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/kinesis from 1.38.0 to 1.43.5

Commits

f9f7a6b Release 2025-07-19
c74fb63 Regenerated Clients
d09b466 generate aws-eusc (#3144)
45575dd Release 2025-07-18
40f9e8b Regenerated Clients
da30009 Update endpoints model
78fe67f Update API model
654c62d Release 2025-07-17
47a74cd Regenerated Clients
bdd96b2 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/kinesis from 1.38.0 to 1.43.5

Commits

f9f7a6b Release 2025-07-19
c74fb63 Regenerated Clients
d09b466 generate aws-eusc (#3144)
45575dd Release 2025-07-18
40f9e8b Regenerated Clients
da30009 Update endpoints model
78fe67f Update API model
654c62d Release 2025-07-17
47a74cd Regenerated Clients
bdd96b2 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/kinesis from 1.38.0 to 1.43.5

Commits

f9f7a6b Release 2025-07-19
c74fb63 Regenerated Clients
d09b466 generate aws-eusc (#3144)
45575dd Release 2025-07-18
40f9e8b Regenerated Clients
da30009 Update endpoints model
78fe67f Update API model
654c62d Release 2025-07-17
47a74cd Regenerated Clients
bdd96b2 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/kinesis from 1.38.0 to 1.43.5

Commits

f9f7a6b Release 2025-07-19
c74fb63 Regenerated Clients
d09b466 generate aws-eusc (#3144)
45575dd Release 2025-07-18
40f9e8b Regenerated Clients
da30009 Update endpoints model
78fe67f Update API model
654c62d Release 2025-07-17
47a74cd Regenerated Clients
bdd96b2 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/kinesis from 1.38.0 to 1.43.5

Commits

f9f7a6b Release 2025-07-19
c74fb63 Regenerated Clients
d09b466 generate aws-eusc (#3144)
45575dd Release 2025-07-18
40f9e8b Regenerated Clients
da30009 Update endpoints model
78fe67f Update API model
654c62d Release 2025-07-17
47a74cd Regenerated Clients
bdd96b2 Update endpoints model
Additional commits viewable in compare view

Updates github.com/nats-io/nats-server/v2 from 2.12.4 to 2.12.6

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.12.6

Changelog

Refer to the 2.12 Upgrade Guide for backwards compatibility notes with 2.11.x.

Go Version

1.25.8

Dependencies

golang.org/x/crypto v0.49.0 (#7953)

github.com/nats-io/jwt/v2 v2.8.1 (#7960)

golang.org/x/sys v0.42.0 (#7923)

golang.org/x/time v0.15.0 (#7923)

CVEs

Fixes CVE-2026-33216, CVE-2026-33217, CVE-2026-33215 (affecting systems using MQTT)

Fixes CVE-2026-33246 (affects systems using leafnodes and service imports)

Fixes CVE-2026-33218 (affects systems using leafnodes)

Fixes CVE-2026-33219 (affects systems using WebSockets)

Fixes CVE-2026-33223, CVE-2026-33222 (affects systems using JetStream)

Fixes CVE-2026-33248 (affects systems using mutual TLS)

Fixes CVE-2026-33247 (affects systems providing credentials on the command line)

Fixes CVE-2026-33249 (affects systems where client publish permissions should be restricted)

Changed

General

There is now a 1MB size limit on JWTs (#7960)

Improved

General

Non-WebSocket leafnode connections can now be proxied using HTTP CONNECT (#7781)

The $SYS.REQ.USER.INFO response now includes the friendly nametag of the account and/or user if known (#7973)

JetStream

The stream peer-remove command now accepts a peer ID as well as a server name (#7952)

MQTT

Protocol compliance has been improved, including more error handling on invalid or malformed MQTT packets (#7933)

Fixed

... (truncated)

Commits

0e06390 Release v2.12.6
f593d27 Cherry-picks for 2.12.6 (#61)
9f904de [FIXED] Incomplete route pool on premature pong
b510192 [FIXED] Avoid stalling read loop on leafnode ErrMinimumVersionRequired
53941c2 Report the account and user name in USER.INFO request
1ab002a [IMPROVED] Support HTTP proxy connection from leaf nodes also for TCP
8b64082 Release v2.12.6-RC.3
e6ab7e9 Cherry-picks for 2.12.6-RC.3 (#59)
9f4d960 Make the deduplication window actually work for deduplication for sourcing
304e184 Remove FIXME about auth callout nonce
Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.4

What's Changed

Fixes Panic in JWE decryption. See https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8

Full Changelog: https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4

Commits

0e59876 Merge commit from fork
ddffdbc Bump actions/checkout from 5 to 6 (#213)
See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Package Dependencies

Package:
github.com/go-jose/go-jose/v4

Ecosystem:
go

Version Change:
4.1.3 → 4.1.4

Update Type:
Patch

Package:
github.com/nats-io/nats-server/v2

Ecosystem:
go

Version Change:
2.12.4 → 2.12.6

Update Type:
Patch

Package:
github.com/aws/aws-sdk-go-v2/service/kinesis

Ecosystem:
go

Version Change:
1.38.0 → 1.43.5

Update Type:
Minor

Security Advisories

Go JOSE Panics in JWE decryption

GHSA-78h2-9frx-2jm8 CVE-2026-34986 HIGH

### Impact Decrypting a JSON Web Encryption (JWE) object will panic if the `alg` field indicates a key wrapping algorithm ([one ending in `KW`](https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg...

NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

GHSA-3f24-pcvm-5jqc CVE-2026-33248 MODERATE

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. One authentication model supported...

NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

GHSA-55h8-8g96-x4hj CVE-2026-33246 MODERATE

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server allows hub/spoke t...

NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

GHSA-pwx7-fx9r-hr4h CVE-2026-33223 MODERATE

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server offers a `Nats-Req...

NATS JetStream has an authorization bypass through its Management API

GHSA-9983-vrx2-fg9c CVE-2026-33222 MODERATE

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The persistent storage feature, Je...

NATS is vulnerable to pre-auth DoS through WebSockets client service

GHSA-8r68-gvr4-jh7j CVE-2026-33219 MODERATE

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server offers a WebSocket...

NATS has pre-auth server panic via leafnode handling

GHSA-vprv-35vv-q339 CVE-2026-33218 HIGH

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server allows hub/spoke t...

NATS allows MQTT clients to bypass ACL checks

GHSA-jxxm-27vp-c3m5 CVE-2026-33217 HIGH

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server provides an MQTT c...

NATS has MQTT plaintext password disclosure

GHSA-v722-jcv5-w7mc CVE-2026-33216 HIGH

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server provides an MQTT c...

NATS is vulnerable to MQTT hijacking via Client ID

GHSA-fcjp-h8cc-6879 CVE-2026-33215 MODERATE

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server provides an MQTT c...

NATS credentials are exposed in monitoring port via command-line argv

GHSA-x6g4-f6q3-fqvv CVE-2026-33247 HIGH

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server provides an option...

NATS: Message tracing can be redirected to arbitrary subject

GHSA-8m2x-3m6q-6w8j CVE-2026-33249 MODERATE

### Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server supports telemetry...

Actions

View on GitHub View Repository All Dependabot PRs

Technical Details

ID:	`15948183`
UUID:	`4221549772`
Node ID:	`PR_kwDOOMD05s7QqpKQ`
Host:	GitHub
Repository:	GoCodeAlone/modular