An open index of dependabot pull requests across open source projects.

dev: bump the safe group across 1 directory with 29 updates

Closed
Number: #7633
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 1
Created: May 26, 2025 at 10:52 PM UTC
(about 1 year ago)
Updated: June 02, 2025 at 11:03 PM UTC
(about 1 year ago)
Closed: June 02, 2025 at 11:03 PM UTC
(about 1 year ago)
Time to Close: 7 days
Labels:
dependencies go
Description:

Bumps the safe group with 17 updates in the / directory:

Package From To
github.com/KimMachineGun/automemlimit 0.7.1 0.7.2
github.com/aws/aws-sdk-go 1.55.6 1.55.7
github.com/emersion/go-smtp 0.21.3 0.22.0
github.com/getsentry/sentry-go 0.31.1 0.33.0
github.com/gorilla/csrf 1.7.2 1.7.3
github.com/hellofresh/health-go/v5 5.5.3 5.5.4
github.com/jackc/pgx/v5 5.7.4 5.7.5
github.com/nats-io/nats-server/v2 2.11.0 2.11.4
github.com/oklog/ulid/v2 2.1.0 2.1.1
github.com/prometheus/client_golang 1.21.1 1.22.0
github.com/redis/go-redis/v9 9.7.3 9.8.0
github.com/spf13/cast 1.7.1 1.8.0
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux 0.60.0 0.61.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.60.0 0.61.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp 0.60.0 0.61.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.35.0 1.36.0
golang.org/x/oauth2 0.28.0 0.30.0

Updates github.com/KimMachineGun/automemlimit from 0.7.1 to 0.7.2

Release notes

Sourced from github.com/KimMachineGun/automemlimit's releases.

v0.7.2

What's Changed

Full Changelog: https://github.com/KimMachineGun/automemlimit/compare/v0.7.1...v0.7.2

Commits
  • a9a712b ci: bump ubuntu version
  • a659ed1 fix(memlimit): fix mountinfo validation logic when super options have spaces
  • b5e3683 chore(examples/gosigar): remove gosigar example
  • See full diff in compare view

Updates github.com/aws/aws-sdk-go from 1.55.6 to 1.55.7

Release notes

Sourced from github.com/aws/aws-sdk-go's releases.

Release v1.55.7 (2025-04-22)

SDK Bugs

  • service/s3/s3manager: Abort multipart download if object is modified during download
Commits

Updates github.com/emersion/go-smtp from 0.21.3 to 0.22.0

Commits
  • 495c409 client: introduce DataCommand
  • f9e8d24 Implement RRVS
  • e2dbc50 server: handle newline characters in error messages
  • b7d48ab Upgrade dependencies
  • 8a5b093 Add checking for auth to Server example
  • c6c3019 server: reset session on EHLO
  • e764d71 client: allow manual Hello after Reset
  • 274020d readme: drop CI badge
  • b63eede client: save greet error
  • 75e52af Allow manual Hello after StartTLS
  • Additional commits viewable in compare view

Updates github.com/getsentry/sentry-go from 0.31.1 to 0.33.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.33.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.33.0.

Breaking Changes

  • Rename the internal Logger to DebugLogger. This feature was only used when you set Debug: True in your sentry.Init() call. If you haven't used the Logger directly, no changes are necessary. (#1012)

Features

  • Add support for Structured Logging. (#1010)

    logger := sentry.NewLogger(ctx)
    logger.Info(ctx, "Hello, Logs!")
    

    You can learn more about Sentry Logs on our docs and the examples.

  • Add new attributes APIs, which are currently only exposed on logs. (#1007)

Bug Fixes

  • Do not push a new scope on StartSpan. (#1013)
  • Fix an issue where the propagated smapling decision wasn't used. (#995)
  • [Otel] Prefer httpRoute over httpTarget for span descriptions. (#1002)

Misc

  • Update github.com/stretchr/testify to v1.8.4. (#988)

0.32.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.32.0.

Breaking Changes

  • Bump the minimum Go version to 1.22. The supported versions are 1.22, 1.23 and 1.24. (#967)
  • Setting any values on span.Extra has no effect anymore. Use SetData(name string, value interface{}) instead. (#864)

Features

  • Add a MockTransport and MockScope. (#972)

Bug Fixes

  • Fix writing *http.Request in the Logrus JSONFormatter. (#955)

Misc

  • Transaction data attributes are now seralized as trace context data attributes, allowing you to query these attributes in the Trace Explorer.
Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.33.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.33.0.

Breaking Changes

  • Rename the internal Logger to DebugLogger. This feature was only used when you set Debug: True in your sentry.Init() call. If you haven't used the Logger directly, no changes are necessary. (#1012)

Features

  • Add support for Structured Logging. (#1010)

    logger := sentry.NewLogger(ctx)
    logger.Info(ctx, "Hello, Logs!")
    

    You can learn more about Sentry Logs on our docs and the examples.

  • Add new attributes APIs, which are currently only exposed on logs. (#1007)

Bug Fixes

  • Do not push a new scope on StartSpan. (#1013)
  • Fix an issue where the propagated smapling decision wasn't used. (#995)
  • [Otel] Prefer httpRoute over httpTarget for span descriptions. (#1002)

Misc

  • Update github.com/stretchr/testify to v1.8.4. (#988)

0.32.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.32.0.

Breaking Changes

  • Bump the minimum Go version to 1.22. The supported versions are 1.22, 1.23 and 1.24. (#967)
  • Setting any values on span.Extra has no effect anymore. Use SetData(name string, value interface{}) instead. (#864)

Features

  • Add a MockTransport and MockScope. (#972)

Bug Fixes

  • Fix writing *http.Request in the Logrus JSONFormatter. (#955)

Misc

... (truncated)

Commits

Updates github.com/gorilla/csrf from 1.7.2 to 1.7.3

Release notes

Sourced from github.com/gorilla/csrf's releases.

v1.7.3

This Release fixes the following:

  • CVE-2025-24358

Full Changelog: https://github.com/gorilla/csrf/compare/v1.7.2...v1.7.3

Commits

Updates github.com/hellofresh/health-go/v5 from 5.5.3 to 5.5.4

Release notes

Sourced from github.com/hellofresh/health-go/v5's releases.

v5.5.4

What's Changed

Full Changelog: https://github.com/hellofresh/health-go/compare/v5.5.3...v5.5.4

In order to fix the security vulnerability in golang.org/x/crypto the minimal go version supported now is 1.23

Commits
  • 2c22af5 Bump golang.org/x/crypto from 0.31.0 to 0.35.0 (#212)
  • 975c863 Merge pull request #202 from hellofresh/patch/EPS-105
  • f00067f remove version from docker-compose.yml
  • d1c916e Bump golang.org/x/net from 0.21.0 to 0.33.0 (#197)
  • 6716ef0 Bump golang.org/x/crypto from 0.20.0 to 0.31.0 (#196)
  • 74007af Update Workflows [ci skip]
  • 41dcaf5 Update Workflows [ci skip]
  • 70a6035 Update Workflows [ci skip]
  • See full diff in compare view

Updates github.com/jackc/pgx/v5 from 5.7.4 to 5.7.5

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.7.5 (May 17, 2025)

  • Support sslnegotiation connection option (divyam234)
  • Update golang.org/x/crypto to v0.37.0. This placates security scanners that were unable to see that pgx did not use the behavior affected by https://pkg.go.dev/vuln/GO-2025-3487.
  • TraceLog now logs Acquire and Release at the debug level (dave sinclair)
  • Add support for PGTZ environment variable
  • Add support for PGOPTIONS environment variable
  • Unpin memory used by Rows quicker
  • Remove PlanScan memoization. This resolves a rare issue where scanning could be broken for one type by first scanning another. The problem was in the memoization system and benchmarking revealed that memoization was not providing any meaningful benefit.
Commits
  • 15bca4a Release v5.7.5
  • 1d557f9 Remove PlanScan memoization
  • de7fe81 Use reflect.TypeFor instead of reflect.TypeOf
  • d9eb089 Remove unused function
  • 6be24eb Fix comment typo
  • 07871c0 Zero internal baseRows references to allow GC earlier
  • 777e7e5 Merge pull request #2313 from stampy88/tracelog_pool_additions
  • 151bd02 Switched to LogLevelDebug
  • 540fcaa Add support for PGOPTIONS environment variable
  • 3a248e3 Add support for PGTZ environment variable
  • Additional commits viewable in compare view

Updates github.com/nats-io/nats-server/v2 from 2.11.0 to 2.11.4

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.11.4

Changelog

Refer to the 2.11 Upgrade Guide for backwards compatibility notes with 2.10.x.

Go Version

Dependencies

  • github.com/nats-io/nats.go v1.42.0 (#6868)
  • golang.org/x/crypto v0.38.0 (#6868)
  • golang.org/x/sys v0.33.0 (#6868)
  • github.com/google/go-tpm v0.9.5 (#6918)

Improved

General

  • Log lines for TLS handshake errors now include the subject and SHA-256 hash of the certificate if known (#6883)

JetStream

  • Enforcing per-subject limits on streams after a state rebuild or retention policy change is now considerably faster (#6871)
  • Reduced allocations when finding the next message matching a filter in the filestore, which also improves the performance of calculating interest state on streams with an interest/WQ retention policy (#6908)

Fixed

General

  • Reloading the gateway TLS configuration now applies to implicit remotes (#6886)

JetStream

  • Stream and consumer updates are no longer possible if all peers are offline, fixing a potential avenue for data loss (#6856)
  • The stream first sequence is now adjusted correctly when purging over interior delete gaps (#6861)
  • Consumer redeliveries are no longer incorrectly reported for consumers with a max deliver of 1 (#6877)
  • Avoid resetting the first and last sequences of a workqueue stream to zero after a crash with unflushed data (#6882)
  • Access time goroutines are now reference-counted and no longer leak (#6887)
  • Fixed a deadlock that could occur when using multi_last direct gets or when calculating the first sequence number for a consumer with a deliver-last-per-subject deliver policy (#6899)
  • A spelling error in a store error was fixed (#6895) Thanks to @​cjohansen for the contribution!
  • A rare panic in the filestore has been fixed (#6912)
  • Direct gets will no longer return messages incorrectly with up_to_time or start_time in some configurations (#6911)
  • Fixed a panic in the stree that could occur when removing subject state tracking for a short subject (#6914)

Complete Changes

https://github.com/nats-io/nats-server/compare/v2.11.3...v2.11.4

... (truncated)

Commits
  • 4c2fc7f Release v2.11.4
  • 5e4e7cc Cherry-picks for 2.11.4 (#6918)
  • 5d5346a Update dependencies
  • be14545 Fix a bug that could cause a panic if subject to delete was shorter then inde...
  • 9fd1d13 Fixed spelling.
  • fb6de55 Release v2.11.4-RC.3
  • e375872 Cherry-picks for 2.11.4-RC.3 (#6913)
  • f941c3b Fix StartTime bug with memory store and only one message
  • 16645b6 Fix MultiLastFor underflow bug with UpToTime before first sequence
  • ff9445e Fix possible panic on filestore.go
  • Additional commits viewable in compare view

Updates github.com/nats-io/nats.go from 1.41.0 to 1.42.0

Release notes

Sourced from github.com/nats-io/nats.go's releases.

Release v1.42.0

Changelog

Overview

This release adds per-key TTL functionality to key-value stores. It adds:

  1. LimitMarkerTTL config option to enable automatic tombstone deletion.
  2. KeyTTL option to kv.Create()
  3. PurgeTTL() option to kv.Purge()

ADDED

  • KeyValue:
    • Added KeyValue per key TTL support and limit markers (#1864)

Complete Changes

https://github.com/nats-io/nats.go/compare/v1.41.2...v1.42.0

Release v1.41.2

Changelog

ADDED

  • Core NATS:
    • Add nc.RemoveStatusListener() method (#1856)

FIXED

  • Legacy JetStream:
    • Fix Fetch and FetchBatch memory leak (#1856)
  • Legacy KeyValue:
    • Use context in when purging stream in kv.PurgeDeletes() (#1858)
  • Bump golang.org/x/crypto to fix vulnerability (#1857)

Complete Changes

https://github.com/nats-io/nats.go/compare/v1.41.1...v1.41.2

Release v1.41.1

Changelog

FIXED

  • ObjectStore:
    • Use default timeout for ObjectStore.Get when no deadline is set on ctx (#1850)

IMPROVED

  • Remove golang.org/x/text dependency (#1849)

Complete Changes

... (truncated)

Commits
  • 70300b2 Release v1.42.0 (#1869)
  • c93af50 [ADDED] KeyValue per key TTL support and limit markers (#1864)
  • d1cdbf5 Release v1.41.2 (#1859)
  • ca54e50 [FIXED] Bump golang.org/x/crypto to fix vulnerability (#1857)
  • aeebc8d [FIXED] Use context in when purging stream in kv.PurgeDeletes() (#1858)
  • 7bfd96a [FIXED] Add RemoveStatusListener method and fixFetch memory leak (#1856)
  • 50e6153 Release v1.41.1 (#1851)
  • e04728e [FIXED] Use default timeout for ObjectStore.Get when no deadline is set on ct...
  • 8a2bd73 [IMPROVED] Remove golang.org/x/text dependency (#1849)
  • See full diff in compare view

Updates github.com/oklog/ulid/v2 from 2.1.0 to 2.1.1

Release notes

Sourced from github.com/oklog/ulid/v2's releases.

v2.1.1

What's Changed

New Contributors

Full Changelog: https://github.com/oklog/ulid/compare/v2.1.0...v2.1.1

Commits

Updates github.com/prometheus/client_golang from 1.21.1 to 1.22.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.22.0 - 2025-04-07

:warning: This release contains potential breaking change if you use experimental zstd support introduce in #1496 :warning:

Experimental support for zstd on scrape was added, controlled by the request Accept-Encoding header. It was enabled by default since version 1.20, but now you need to add a blank import to enable it. The decision to make it opt-in by default was originally made because the Go standard library was expected to have default zstd support added soon, golang/go#62513 however, the work took longer than anticipated and it will be postponed to upcoming major Go versions.

e.g.:

import (
  _ "github.com/prometheus/client_golang/prometheus/promhttp/zstd"
)
  • [FEATURE] prometheus: Add new CollectorFunc utility #1724
  • [CHANGE] Minimum required Go version is now 1.22 (we also test client_golang against latest go version - 1.24) #1738
  • [FEATURE] api: WithLookbackDelta and WithStats options have been added to API client. #1743
  • [CHANGE] :warning: promhttp: Isolate zstd support and klauspost/compress library use to promhttp/zstd package. #1765

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.22.0 / 2025-04-07

:warning: This release contains potential breaking change if you use experimental zstd support introduce in #1496 :warning:

Experimental support for zstd on scrape was added, controlled by the request Accept-Encoding header. It was enabled by default since version 1.20, but now you need to add a blank import to enable it. The decision to make it opt-in by default was originally made because the Go standard library was expected to have default zstd support added soon, golang/go#62513 however, the work took longer than anticipated and it will be postponed to upcoming major Go versions.

e.g.:

import (
  _ "github.com/prometheus/client_golang/prometheus/promhttp/zstd"
)
  • [FEATURE] prometheus: Add new CollectorFunc utility #1724
  • [CHANGE] Minimum required Go version is now 1.22 (we also test client_golang against latest go version - 1.24) #1738
  • [FEATURE] api: WithLookbackDelta and WithStats options have been added to API client. #1743
  • [CHANGE] :warning: promhttp: Isolate zstd support and klauspost/compress library use to promhttp/zstd package. #1765
Commits
  • d50be25 Cut 1.22.0 (#1793)
  • 1043db7 Cut 1.22.0-rc.0 (#1768)
  • e575c9c promhttp: Isolate zstd support and klauspost/compress library use to promhttp...
  • f2276aa Merge pull request #1764 from prometheus/dependabot/github_actions/github-act...
  • 9df772c build(deps): bump peter-evans/create-pull-request
  • a3548c5 Merge pull request #1754 from saswatamcode/exp-eh
  • 60fd2b0 Remove go.work file for now
  • 8f9d0de exp: Add dependabot config
  • c5cf981 Merge pull request #1762 from prometheus/release-1.21
  • e84c305 exp: Reset snappy buf (#1756)
  • Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.7.3 to 9.8.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

v9.8.0

9.8.0 (2025-04-30)

🚀 Highlights

  • Redis 8 Support: Full compatibility with Redis 8.0, including testing and CI integration
  • Enhanced Hash Operations: Added support for new hash commands (HGETDEL, HGETEX, HSETEX) and HSTRLEN command
  • Search Improvements: Enabled Search DIALECT 2 by default and added CountOnly argument for FT.Search

✨ New Features

  • Added support for new hash commands: HGETDEL, HGETEX, HSETEX (#3305)
  • Added HSTRLEN command for hash operations (#2843)
  • Added Do method for raw query by single connection from pool.Conn() (#3182)
  • Prevent false-positive marshaling by treating zero time.Time as empty in isEmptyValue (#3273)
  • Added FailoverClusterClient support for Universal client (#2794)
  • Added support for cluster mode with IsClusterMode config parameter (#3255)
  • Added client name support in HELLO RESP handshake (#3294)
  • Enabled Search DIALECT 2 by default (#3213)
  • Added read-only option for failover configurations (#3281)
  • Added CountOnly argument for FT.Search to use LIMIT 0 0 (#3338)
  • Added DB option support in NewFailoverClusterClient (#3342)
  • Added nil check for the options when creating a client (#3363)

🐛 Bug Fixes

  • Fixed PubSub concurrency safety issues (#3360)
  • Fixed panic caused when argument is nil (#3353)
  • Improved error handling when fetching master node from sentinels (#3349)
  • Fixed connection pool timeout issues and increased retries (#3298)
  • Fixed context cancellation error leading to connection spikes on Primary instances (#3190)
  • Fixed RedisCluster client to consider MASTERDOWN a retriable error (#3164)
  • Fixed tracing to show complete commands instead of truncated versions (#3290)
  • Fixed OpenTelemetry instrumentation to prevent multiple span reporting (#3168)
  • Fixed FT.Search Limit argument and added CountOnly argument for limit 0 0 (#3338)
  • Fixed missing command in interface (#3344)
  • Fixed slot calculation for COUNTKEYSINSLOT command (#3327)
  • Updated PubSub implementation with correct context (#3329)

📚 Documentation

  • Added hash search examples (#3357)
  • Fixed documentation comments (#3351)
  • Added CountOnly search example (#3345)
  • Added examples for list commands: LLEN, LPOP, LPUSH, LRANGE, RPOP, RPUSH (#3234)
  • Added SADD and SMEMBERS command examples (#3242)
  • Updated README.md to use Redis Discord guild (#3331)
  • Updated HExpire command documentation (#3355)
  • Featured OpenTelemetry instrumentation more prominently (#3316)
  • Updated README.md with additional information (#310ce55)

⚡ Performance and Reliability

  • Bound connection pool background dials to configured dial timeout (#3089)
  • Ensured context isn't exhausted via concurrent query (#3334)

... (truncated)

Commits

Updates github.com/spf13/cast from 1.7.1 to 1.8.0

Release notes

Sourced from github.com/spf13/cast's releases.

v1.8.0

What's Changed

New Contributors

Full Changelog: https://github.com/spf13/cast/compare/v1.7.1...v1.8.0

Commits
Package Dependencies
Ecosystem:
go
Version Change:
0.28.0 → 0.30.0
Update Type:
Minor
Ecosystem:
go
Version Change:
1.21.1 → 1.22.0
Update Type:
Minor
Ecosystem:
go
Version Change:
9.7.3 → 9.8.0
Update Type:
Minor
Ecosystem:
go
Version Change:
1.7.1 → 1.8.0
Update Type:
Minor
Ecosystem:
go
Version Change:
0.60.0 → 0.61.0
Update Type:
Minor
Ecosystem:
go
Version Change:
1.35.0 → 1.36.0
Update Type:
Minor
Ecosystem:
go
Version Change:
1.55.6 → 1.55.7
Update Type:
Patch
Ecosystem:
go
Version Change:
0.60.0 → 0.61.0
Update Type:
Minor
Ecosystem:
go
Version Change:
0.31.1 → 0.33.0
Update Type:
Minor
Ecosystem:
go
Version Change:
2.11.0 → 2.11.4
Update Type:
Patch
Ecosystem:
go
Version Change:
0.60.0 → 0.61.0
Update Type:
Minor
Ecosystem:
go
Version Change:
1.7.2 → 1.7.3
Update Type:
Patch
Ecosystem:
go
Version Change:
0.7.1 → 0.7.2
Update Type:
Patch
Ecosystem:
go
Version Change:
5.7.4 → 5.7.5
Update Type:
Patch
Ecosystem:
go
Version Change:
0.21.3 → 0.22.0
Update Type:
Minor
Ecosystem:
go
Version Change:
5.5.3 → 5.5.4
Update Type:
Patch
Ecosystem:
go
Version Change:
2.1.0 → 2.1.1
Update Type:
Patch
Technical Details
ID: 670687
UUID: 2544923411
Node ID: PR_kwDOCdvj-c6XsHMT
Host: GitHub
Repository: TheThingsNetwork/lorawan-stack
Mergeable: Yes
Merge State: Unstable
Rebaseable: Yes