Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

dev: bump the safe group across 1 directory with 43 updates

Closed
Number: #7797
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 1
Created: December 22, 2025 at 10:11 PM UTC
(6 months ago)
Updated: February 03, 2026 at 03:58 AM UTC
(4 months ago)
Closed: February 03, 2026 at 03:58 AM UTC
(4 months ago)
Time to Close: about 1 month
Labels:
dependencies go
Description:

Bumps the safe group with 30 updates in the / directory:

Package From To
github.com/KimMachineGun/automemlimit 0.7.4 0.7.5
github.com/aws/aws-sdk-go 1.55.7 1.55.8
github.com/aws/aws-sdk-go-v2/config 1.29.12 1.32.6
github.com/aws/aws-sdk-go-v2/service/s3 1.78.2 1.94.0
github.com/coder/websocket 1.8.13 1.8.14
github.com/eclipse/paho.mqtt.golang 1.5.0 1.5.1
github.com/emersion/go-smtp 0.22.0 0.24.0
github.com/envoyproxy/protoc-gen-validate 1.2.1 1.3.0
github.com/getsentry/sentry-go 0.34.1 0.40.0
github.com/grpc-ecosystem/grpc-gateway/v2 2.27.1 2.27.3
github.com/jackc/pgx/v5 5.7.5 5.7.6
github.com/jarcoal/httpmock 1.4.0 1.4.1
github.com/klauspost/compress 1.18.0 1.18.2
github.com/nats-io/nats-server/v2 2.11.4 2.12.3
github.com/prometheus/client_golang 1.22.0 1.23.2
github.com/redis/go-redis/v9 9.11.0 9.17.2
github.com/spf13/cast 1.9.2 1.10.0
github.com/spf13/cobra 1.9.1 1.10.2
github.com/spf13/viper 1.20.1 1.21.0
github.com/throttled/throttled/v2 2.13.0 2.15.0
github.com/uptrace/bun 1.2.14 1.2.16
github.com/uptrace/bun/dialect/pgdialect 1.2.14 1.2.16
github.com/uptrace/bun/driver/pgdriver 1.2.14 1.2.16
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux 0.62.0 0.64.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.62.0 0.64.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp 0.62.0 0.64.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.37.0 1.39.0
go.thethings.network/lorawan-stack-legacy/v2 2.1.0 2.1.1
go.uber.org/zap 1.27.0 1.27.1
golang.org/x/oauth2 0.30.0 0.34.0

Updates github.com/KimMachineGun/automemlimit from 0.7.4 to 0.7.5

Release notes

Sourced from github.com/KimMachineGun/automemlimit's releases.

v0.7.5

What's Changed

Full Changelog: https://github.com/KimMachineGun/automemlimit/compare/v0.7.4...v0.7.5

Commits

Updates github.com/aws/aws-sdk-go from 1.55.7 to 1.55.8

Release notes

Sourced from github.com/aws/aws-sdk-go's releases.

Release v1.55.8 (2025-07-31)

SDK Features

  • Mark the module and all packages as deprecated.
    • This SDK has entered end-of-support.
Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.29.12 to 1.32.6

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.78.2 to 1.94.0

Commits

Updates github.com/coder/websocket from 1.8.13 to 1.8.14

Release notes

Sourced from github.com/coder/websocket's releases.

v1.8.14

Changes

New Contributors

Full Changelog: https://github.com/coder/websocket/compare/v1.8.13...v1.8.14

Commits

Updates github.com/eclipse/paho.mqtt.golang from 1.5.0 to 1.5.1

Release notes

Sourced from github.com/eclipse/paho.mqtt.golang's releases.

v1.5.1

This is a minor release incorporating changes made in the 14 months since v1.5.0 (including updating dependencies, and raising the Go version to 1.24). The changes are relatively minor but address a potential security issue (CVE-2025-10543), possible panic, enable users to better monitor the connection status, and incorporate a few optimisations.

Thanks to those who have provided fixes/enhancements included in this release!

Special thanks to Paul Gerste at Sonar for reporting issue #730 via the Eclipse security team (fix was implemented in PR #714 in May, github issue created just prior to this release). This issue arose where a topic > 65535 bytes was passed to the Publish function, due to the way the data was encoded the topic could leak into the message body. Please see issue #730 or CVE-2025-10543 for further details.

What's Changed

Full Changelog: https://github.com/eclipse-paho/paho.mqtt.golang/compare/v1.5.0...v1.5.1

Commits
  • b305237 Update dependencies in docker examples
  • 35ee03d Potential panic when using manual ACK
  • 433bd22 address data race in test
  • 4debe3a Potential panic when using manual ACK
  • 601453b Resolve issues in fvt_client_test
  • 439e2ab Dependency update (also rise Go version to 1.24)
  • d276593 ConnectionNotificationHandler - generic callback for all types of connection ...
  • 8a350a9 notifications
  • 5620c5e notifications
  • 45048cc notifications
  • Additional commits viewable in compare view

Updates github.com/emersion/go-smtp from 0.22.0 to 0.24.0

Commits
  • ab24fe7 Remove superfluous validateLine() calls in sendMail()
  • 6944e33 Implement MT-PRIORITY (RFC 6710)
  • 54dd31d Implement DELIVERBY (RFC 2852)
  • See full diff in compare view

Updates github.com/envoyproxy/protoc-gen-validate from 1.2.1 to 1.3.0

Release notes

Sourced from github.com/envoyproxy/protoc-gen-validate's releases.

v1.3.0

What's Changed

... (truncated)

Commits
  • 4eb9011 Python 3.13 support in validator.py (#1326)
  • ad5af80 Bump golang.org/x/net from 0.46.0 to 0.47.0 in /tests in the go-tests group (...
  • b02a069 Bump the java group across 1 directory with 3 updates (#1328)
  • c3d7b9b Bump the java group in /java with 3 updates (#1323)
  • 0b3cccf Bump actions/upload-artifact from 4 to 5 in the github-actions group (#1324)
  • 3c1639c Bump golang.org/x/net from 0.44.0 to 0.46.0 in /tests in the go-tests group (...
  • 552d005 Bump the java group in /java with 2 updates (#1320)
  • 519c9ce Bump google.golang.org/protobuf from 1.36.9 to 1.36.10 in /tests in the go-te...
  • 962aec3 Bump the java group in /java with 3 updates (#1316)
  • e1caab2 Bump isort from 6.0.1 to 6.1.0 in the python-root group (#1317)
  • Additional commits viewable in compare view

Updates github.com/getsentry/sentry-go from 0.34.1 to 0.40.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.40.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.40.0.

Bug Fixes

  • Disable DisableTelemetryBuffer flag and noop Telemetry Buffer, to prevent a panic at runtime (#1149).

0.39.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.39.0.

Features

  • Drop events from the telemetry buffer when rate-limited or transport is full, allowing the buffer queue to empty itself under load (#1138).

Bug Fixes

  • Fix scheduler's hasWork() method to check if buffers are ready to flush. The previous implementation was causing CPU spikes (#1143).

0.38.0

Breaking Changes

Features

  • Introduce a new async envelope transport and telemetry buffer to prioritize and batch events (#1094, #1093, #1107).

    • Advantages:
      • Prioritized, per-category buffers (errors, transactions, logs, check-ins) reduce starvation and improve resilience under load
      • Batching for high-volume logs (up to 100 items or 5s) cuts network overhead
      • Bounded memory with eviction policies
      • Improved flush behavior with context-aware flushing

  • Add ClientOptions.DisableTelemetryBuffer to opt out and fall back to the legacy transport layer (HTTPTransport / HTTPSyncTransport).

    err := sentry.Init(sentry.ClientOptions{
  Dsn: "__DSN__",
  DisableTelemetryBuffer: true, // fallback to legacy transport
})

Notes

  • If a custom Transport is provided, the SDK automatically disables the telemetry buffer and uses the legacy transport for compatibility.

0.37.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.37.0.

Breaking Changes

  • Behavioral change for the TraceIgnoreStatusCodes option. The option now defaults to ignoring 404 status codes (#1122).

Features

... (truncated)

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.40.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.40.0.

Bug Fixes

  • Disable DisableTelemetryBuffer flag and noop Telemetry Buffer, to prevent a panic at runtime (#1149).

0.39.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.39.0.

Features

  • Drop events from the telemetry buffer when rate-limited or transport is full, allowing the buffer queue to empty itself under load (#1138).

Bug Fixes

  • Fix scheduler's hasWork() method to check if buffers are ready to flush. The previous implementation was causing CPU spikes (#1143).

0.38.0

Breaking Changes

Features

  • Introduce a new async envelope transport and telemetry buffer to prioritize and batch events (#1094, #1093, #1107).

    • Advantages:
      • Prioritized, per-category buffers (errors, transactions, logs, check-ins) reduce starvation and improve resilience under load
      • Batching for high-volume logs (up to 100 items or 5s) cuts network overhead
      • Bounded memory with eviction policies
      • Improved flush behavior with context-aware flushing

  • Add ClientOptions.DisableTelemetryBuffer to opt out and fall back to the legacy transport layer (HTTPTransport / HTTPSyncTransport).

    err := sentry.Init(sentry.ClientOptions{
  Dsn: "__DSN__",
  DisableTelemetryBuffer: true, // fallback to legacy transport
})

Notes

  • If a custom Transport is provided, the SDK automatically disables the telemetry buffer and uses the legacy transport for compatibility.

0.37.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.37.0.

Breaking Changes

... (truncated)

Commits

Updates github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.1 to 2.27.3

Release notes

Sourced from github.com/grpc-ecosystem/grpc-gateway/v2's releases.

v2.27.3

What's Changed

New Contributors

Full Changelog: https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.27.2...v2.27.3

v2.27.2

What's Changed

New Contributors

Full Changelog: https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.27.1...v2.27.2

Commits
  • ab243ac chore(deps): update googleapis digest to 9070e63 (#5970)
  • 30abf93 fix(deps): update module google.golang.org/protobuf to v1.36.10 (#5969)
  • b73048f chore(deps): update dependency bazel to v8.4.2 (#5968)
  • 95f123b chore(deps): update googleapis digest to 3990e05 (#5967)
  • fb9da67 chore(deps): update googleapis digest to 063f9e1 (#5966)
  • 208372a chore(deps): update googleapis digest to e78280f (#5965)
  • 1a315aa fix(deps): update google.golang.org/genproto/googleapis/api digest to 57b25ae...
  • b862f0b fix(deps): update google.golang.org/genproto/googleapis/rpc digest to 57b25ae...
  • e6cdbc7 chore(deps): update googleapis digest to eab82ec (#5962)
  • 7fefac0 chore(deps): update googleapis digest to a4ded73 (#5961)
  • Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.7.5 to 5.7.6

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.7.6 (September 8, 2025)

  • Use ParseConfigError in pgx.ParseConfig and pgxpool.ParseConfig (Yurasov Ilia)
  • Add PrepareConn hook to pgxpool (Jonathan Hall)
  • Reduce allocations in QueryContext (Dominique Lefevre)
  • Add MarshalJSON and UnmarshalJSON for pgtype.Uint32 (Panos Koutsovasilis)
  • Configure ping behavior on pgxpool with ShouldPing (Christian Kiely)
  • zeronull int types implement Int64Valuer and Int64Scanner (Li Zeghong)
  • Fix panic when receiving terminate connection message during CopyFrom (Michal Drausowski)
  • Fix statement cache not being invalidated on error during batch (Muhammadali Nazarov)
Commits
  • a2fca03 Release v5.7.6
  • 95fc312 Add link to github.com/KoNekoD/pgx-colon-query-rewriter
  • 5534fa9 Improve Rows docs
  • a295d68 Merge pull request #2368 from zeghong/zeronull-int-valuer
  • 03f32c0 Merge branch 'master' into zeronull-int-valuer
  • 82fbe49 Merge pull request #2372 from WGH-/improve-batch-doc
  • 594d9d6 Merge pull request #2367 from zeghong/zeronull-int-scanner
  • 5a18241 Merge branch 'master' into zeronull-int-scanner
  • cc34da5 Merge pull request #2370 from Saurabh2402/improvement/setup-linters
  • dd81f81 Merge pull request #2369 from zeghong/go-doc-links
  • Additional commits viewable in compare view

Updates github.com/jarcoal/httpmock from 1.4.0 to 1.4.1

Release notes

Sourced from github.com/jarcoal/httpmock's releases.

v1.4.1

What's Changed

New Contributors

Full Changelog: https://github.com/jarcoal/httpmock/compare/v1.4.0...v1.4.1

Commits
  • 314d58a fix: protect all body-related methods with mutext
  • e482896 fix: avoid data race when closing body
  • c977145 test: also test with go v1.25 and use golangci-lint v2.4.0
  • See full diff in compare view

Updates github.com/klauspost/compress from 1.18.0 to 1.18.2

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.18.2

What's Changed

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

Full Changelog: https://github.com/klauspost/compress/compare/v1.18.1...v1.18.2

v1.18.1

What's Changed

New Contributors

Full Changelog: https://github.com/klauspost/compress/compare/v1.18.0...v1.18.1

Commits

Updates github.com/nats-io/nats-server/v2 from 2.11.4 to 2.12.3

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.12.3

Changelog

Refer to the 2.12 Upgrade Guide for backwards compatibility notes with 2.11.x.

Go Version

Dependencies

  • github.com/google/go-tpm v0.9.7 (#7578)
  • github.com/nats-io/nkeys v0.4.12 (#7578)
  • golang.org/x/crypto v0.45.0 (#7578)
  • github.com/klauspost/compress v1.18.2 (#7604)
  • github.com/antithesishq/antithesis-sdk-go v0.5.0...

    Description has been truncated

Package Dependencies
Package:
github.com/aws/aws-sdk-go-v2/service/s3
Ecosystem:
go
Version Change:
1.78.2 → 1.94.0
Update Type:
Minor
Package:
github.com/spf13/viper
Ecosystem:
go
Version Change:
1.20.1 → 1.21.0
Update Type:
Minor
Package:
github.com/spf13/cobra
Ecosystem:
go
Version Change:
1.9.1 → 1.10.2
Update Type:
Minor
Package:
golang.org/x/oauth2
Ecosystem:
go
Version Change:
0.30.0 → 0.34.0
Update Type:
Minor
Package:
github.com/prometheus/client_golang
Ecosystem:
go
Version Change:
1.22.0 → 1.23.2
Update Type:
Minor
Package:
github.com/redis/go-redis/v9
Ecosystem:
go
Version Change:
9.11.0 → 9.17.2
Update Type:
Minor
Package:
github.com/spf13/cast
Ecosystem:
go
Version Change:
1.9.2 → 1.10.0
Update Type:
Minor
Package:
github.com/coder/websocket
Ecosystem:
go
Version Change:
1.8.13 → 1.8.14
Update Type:
Patch
Package:
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
Ecosystem:
go
Version Change:
0.62.0 → 0.64.0
Update Type:
Minor
Package:
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
Ecosystem:
go
Version Change:
1.37.0 → 1.39.0
Update Type:
Minor
Package:
github.com/aws/aws-sdk-go
Ecosystem:
go
Version Change:
1.55.7 → 1.55.8
Update Type:
Patch
Package:
go.uber.org/zap
Ecosystem:
go
Version Change:
1.27.0 → 1.27.1
Update Type:
Patch
Package:
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
Ecosystem:
go
Version Change:
0.62.0 → 0.64.0
Update Type:
Minor
Package:
github.com/aws/aws-sdk-go-v2/config
Ecosystem:
go
Version Change:
1.29.12 → 1.32.6
Update Type:
Minor
Package:
github.com/getsentry/sentry-go
Ecosystem:
go
Version Change:
0.34.1 → 0.40.0
Update Type:
Minor
Package:
github.com/grpc-ecosystem/grpc-gateway/v2
Ecosystem:
go
Version Change:
2.27.1 → 2.27.3
Update Type:
Patch
Package:
github.com/nats-io/nats-server/v2
Ecosystem:
go
Version Change:
2.11.4 → 2.12.3
Update Type:
Minor
Package:
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux
Ecosystem:
go
Version Change:
0.62.0 → 0.64.0
Update Type:
Minor
Package:
github.com/jarcoal/httpmock
Ecosystem:
go
Version Change:
1.4.0 → 1.4.1
Update Type:
Patch
Package:
github.com/KimMachineGun/automemlimit
Ecosystem:
go
Version Change:
0.7.4 → 0.7.5
Update Type:
Patch
Package:
github.com/jackc/pgx/v5
Ecosystem:
go
Version Change:
5.7.5 → 5.7.6
Update Type:
Patch
Package:
github.com/klauspost/compress
Ecosystem:
go
Version Change:
1.18.0 → 1.18.2
Update Type:
Patch
Package:
github.com/eclipse/paho.mqtt.golang
Ecosystem:
go
Version Change:
1.5.0 → 1.5.1
Update Type:
Patch
Package:
github.com/emersion/go-smtp
Ecosystem:
go
Version Change:
0.22.0 → 0.24.0
Update Type:
Minor
Package:
github.com/envoyproxy/protoc-gen-validate
Ecosystem:
go
Version Change:
1.2.1 → 1.3.0
Update Type:
Minor
Package:
github.com/uptrace/bun
Ecosystem:
go
Version Change:
1.2.14 → 1.2.16
Update Type:
Patch
Package:
github.com/uptrace/bun/dialect/pgdialect
Ecosystem:
go
Version Change:
1.2.14 → 1.2.16
Update Type:
Patch
Package:
github.com/uptrace/bun/driver/pgdriver
Ecosystem:
go
Version Change:
1.2.14 → 1.2.16
Update Type:
Patch
Package:
github.com/throttled/throttled/v2
Ecosystem:
go
Version Change:
2.13.0 → 2.15.0
Update Type:
Minor
Package:
go.thethings.network/lorawan-stack-legacy/v2
Ecosystem:
go
Version Change:
2.1.0 → 2.1.1
Update Type:
Patch
Security Advisories
Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes
GHSA-32fw-gq77-f2f2 CVE-2025-10543 MODERATE
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lea...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 13434808
UUID: 3755381679
Node ID: PR_kwDOCdvj-c66OeE1
Host: GitHub
Repository: TheThingsNetwork/lorawan-stack