An open index of dependabot pull requests across open source projects.

build(deps): Bump the all-go group across 8 directories with 20 updates

Closed
Number: #2546
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 1
Created: August 08, 2025 at 10:02 AM UTC
(10 months ago)
Updated: August 08, 2025 at 11:01 AM UTC
(10 months ago)
Closed: August 08, 2025 at 11:01 AM UTC
(10 months ago)
Time to Close: about 1 hour
Labels:
T:dependencies
Description:

Bumps the all-go group with 7 updates in the / directory:

Package From To
github.com/celestiaorg/go-header 0.6.6 0.7.0
github.com/libp2p/go-libp2p-pubsub 0.14.1 0.14.2
github.com/multiformats/go-multiaddr 0.16.0 0.16.1
github.com/spf13/pflag 1.0.6 1.0.7
golang.org/x/crypto 0.40.0 0.41.0
golang.org/x/net 0.42.0 0.43.0
google.golang.org/protobuf 1.36.6 1.36.7

Bumps the all-go group with 8 updates in the /apps/testapp directory:

Package From To
github.com/libp2p/go-libp2p-pubsub 0.14.1 0.14.2
github.com/multiformats/go-multiaddr 0.16.0 0.16.1
github.com/spf13/pflag 1.0.6 1.0.7
golang.org/x/crypto 0.40.0 0.41.0
golang.org/x/net 0.42.0 0.43.0
google.golang.org/protobuf 1.36.6 1.36.7
github.com/celestiaorg/go-square/v2 2.2.0 2.3.1
github.com/filecoin-project/go-jsonrpc 0.7.1 0.8.0

Bumps the all-go group with 4 updates in the /da directory: github.com/rs/zerolog, google.golang.org/protobuf, github.com/celestiaorg/go-square/v2 and github.com/filecoin-project/go-jsonrpc.
Bumps the all-go group with 5 updates in the /execution/evm directory:

Package From To
github.com/prometheus/client_golang 1.20.5 1.23.0
github.com/spf13/pflag 1.0.6 1.0.7
github.com/ethereum/go-ethereum 1.15.0 1.16.2
github.com/golang-jwt/jwt/v5 5.2.2 5.3.0
github.com/testcontainers/testcontainers-go/modules/compose 0.37.0 0.38.0

Bumps the all-go group with 2 updates in the /execution/grpc directory: golang.org/x/net and google.golang.org/protobuf.
Bumps the all-go group with 7 updates in the /sequencers/single directory:

Package From To
github.com/celestiaorg/go-header 0.6.6 0.7.0
github.com/libp2p/go-libp2p-pubsub 0.14.1 0.14.2
github.com/multiformats/go-multiaddr 0.16.0 0.16.1
github.com/spf13/pflag 1.0.6 1.0.7
golang.org/x/crypto 0.40.0 0.41.0
golang.org/x/net 0.42.0 0.43.0
google.golang.org/protobuf 1.36.6 1.36.7

Bumps the all-go group with 8 updates in the /test/docker-e2e directory:

Package From To
github.com/prometheus/client_golang 1.20.5 1.23.0
github.com/rs/zerolog 1.33.0 1.34.0
github.com/spf13/cobra 1.8.1 1.9.1
github.com/spf13/viper 1.19.0 1.20.1
google.golang.org/protobuf 1.36.6 1.36.7
github.com/celestiaorg/go-square/v2 2.2.0 2.3.1
github.com/celestiaorg/tastora 0.0.4 0.2.0
cosmossdk.io/math 1.4.0 1.5.3

Bumps the all-go group with 10 updates in the /test/e2e directory:

Package From To
github.com/celestiaorg/go-header 0.6.6 0.7.0
github.com/libp2p/go-libp2p-pubsub 0.14.1 0.14.2
github.com/multiformats/go-multiaddr 0.16.0 0.16.1
github.com/spf13/pflag 1.0.6 1.0.7
golang.org/x/crypto 0.40.0 0.41.0
golang.org/x/net 0.42.0 0.43.0
google.golang.org/protobuf 1.36.6 1.36.7
github.com/ethereum/go-ethereum 1.15.0 1.16.2
github.com/golang-jwt/jwt/v5 5.2.2 5.3.0
github.com/testcontainers/testcontainers-go/modules/compose 0.37.0 0.38.0

Updates github.com/celestiaorg/go-header from 0.6.6 to 0.7.0

Release notes

Sourced from github.com/celestiaorg/go-header's releases.

v0.7.0

v0.7.0 release brings high-performance dynamic Tail maintenance for Syncer, also known as header pruning.

Notable Changes

Syncer

These new fields were introduced to Syncer's config:

        // PruningWindow defines the duration within which headers are retained before being pruned.
        // Default is 337 hours.
	PruningWindow time.Duration
	// SyncFromHash is the hash of the header from which Syncer should start syncing.
	// Zero value to disable. Value updates up and down the chain are gracefully handled by Syncer.
	//
	// By default, Syncer maintains PruningWindow number of headers. SyncFromHash overrides this default,
	// allowing any user to specify a custom starting point.
	//
	// SyncFromHash has higher priority than SyncFromHeight.
	SyncFromHash string
	// SyncFromHeight is the height of the header from which Syncer should start syncing.
	// Zero value to disable. Value updates up and down the chain are gracefully handled by Syncer.
	//
	// By default, Syncer maintains PruningWindow number of headers. SyncFromHeight overrides this default,
	// allowing any user to specify a custom starting point.
	//
	// SyncFromHeight has lower priority than SyncFromHash.
	SyncFromHeight uint64

Store

  • store.Store.DeleteTo method (celestiaorg/go-header#275)
  • store.Store.OnDelete method, which allows users to register individual header deletion handlers. This will enable users to execute farewell logic when headers are removed, e.g., cleanup data committed in the header but stored separately. (celestiaorg/go-header#320)
  • Unsafe store recovery tools (celestiaorg/go-header#325)

Breaks

  • store.Store.Init and store.Init were removed. Initialization is now performed lazily using the first header given to store.Append (celestiaorg/go-header#274)

What's Changed

... (truncated)

Commits

Updates github.com/libp2p/go-libp2p from 0.41.1 to 0.42.0

Release notes

Sourced from github.com/libp2p/go-libp2p's releases.

v0.42.0

⚠ Breaking Changes

Added a new method, VerifySourceAddress(net.Addr) bool, to the Resource Manager interface. For more details see the Source Address Verification section.

For custom implementation which want to opt out of Source Address Verification and keep the existing behavior, return false from the method.

🔦 Highlights

Per Address Reachability via AutoNAT v2

libp2p hosts can now determine reachability for individual addresses using AutoNATV2. To opt in to reachability checking use the EnableAutoNATV2 libp2p option. Using this nodes can now determine their IPv4, IPv6, and browser address reachability separately. In a future release, AutoRelay will use this information and make appropriate relay reservations accordingly. https://pkg.go.dev/github.com/libp2p/go-libp2p#EnableAutoNATv2

To query addresses by their reachability, ConfirmedAddrs() (reachable, unreachable, unknown []ma.Multiaddr) that provides Reachability information per host address. https://pkg.go.dev/github.com/libp2p/go-libp2p/p2p/host/basic#BasicHost.ConfirmedAddrs For notifications, Subscribe to the event event.EvtHostReachableAddrsChanged https://pkg.go.dev/github.com/libp2p/go-libp2p/core/event#EvtHostReachableAddrsChanged

Rate Limiting

We've introduced the package github.com/libp2p/go-libp2p/x/rate for rate limiting. The struct rate.Limiter provides Global, Network Specific, and Subnet Specific rate limiting. The Subnet specific rate limits allows for better DoS Protection by rate limiting malicious IPs. https://pkg.go.dev/github.com/libp2p/go-libp2p/x/rate

Use Limit(f func(s network.Stream)) func(s network.Stream) on Limiter to limit specific stream handlers. For example, within libp2p, the Identify Service uses this as ids.Host.SetStreamHandler(IDPush, ids.rateLimiter.Limit(ids.handlePush)) to rate limit the number of times peers can perform identify push.

For non Stream use cases use the Allow(ip) method on the limiter.

Connection Rate Limiting

New connection requests are now rate limited per IP. By default we allow 1 connection every 5 seconds from an IP address with a burst of 16 connections per IP. The burst is high enough that this should only block malicious peers.

To configure the connection rate limits, use the WithConnRateLimiters option on the Resource Manager. https://pkg.go.dev/github.com/libp2p/go-libp2p/p2p/host/resource-manager#WithConnRateLimiters

Source Address Verification for QUIC

This release introduces Source Address Verification for QUIC, preventing DoS attacks by spoofing IP addresses. See: https://www.rfc-editor.org/rfc/rfc9000.html#section-8 for details.

We are now gating incoming QUIC connections before the handshake is started. This further improves DoS protection by not wasting CPU on handshaking QUIC connections which would have been dropped by the Resource Manager.

Other changes

  • WebRTC Direct peers can now send messages of up to 256 kB (see spec: libp2p/specs#628)
  • Refactored the addressing code within BasicHost and moved it into Address Manager. In a future release, this will be exposed to users with an improved Address API for the libp2p Host.

What's Changed

... (truncated)

Commits

Updates github.com/libp2p/go-libp2p-pubsub from 0.14.1 to 0.14.2

Release notes

Sourced from github.com/libp2p/go-libp2p-pubsub's releases.

v0.14.2

What's Changed

Full Changelog: https://github.com/libp2p/go-libp2p-pubsub/compare/v0.14.1...v0.14.2

Commits

Updates github.com/multiformats/go-multiaddr from 0.16.0 to 0.16.1

Release notes

Sourced from github.com/multiformats/go-multiaddr's releases.

v0.16.1

What's Changed

Full Changelog: https://github.com/multiformats/go-multiaddr/compare/v0.16.0...v0.16.1

Commits

Updates github.com/spf13/pflag from 1.0.6 to 1.0.7

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.7

What's Changed

New Contributors

Full Changelog: https://github.com/spf13/pflag/compare/v1.0.6...v1.0.7

Commits
  • f9cbdd9 Merge pull request #348 from max-frank/add-time-flag-support
  • e3be2eb Reduce duplication by forwarding to sibling functions
  • 7cc25e3 Don't export TimeValue (yet)
  • d15848d Remove unnecessary time test stderr dev null redirect
  • c5ce22e Use time.Time for expectations in time flag tests
  • 1992c5a Add support for time.Time flags
  • 1c62fb2 Merge pull request #431 from LeGEC/430-fix-usage-message-for-func-flags
  • 1a4b5b2 fix discrepancy in order of arguments for Func() and BoolFunc() #433
  • 4730aa0 fix help message for Func and BoolFunc flags #430
  • f4c97c2 minor: fix typos in comments
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.40.0 to 0.41.0

Commits
  • ef5341b go.mod: update golang.org/x dependencies
  • b999374 acme: fix pebble subprocess output data race
  • c247dea x509roots/fallback: store bundle certs directly in DER
  • 1fda731 acme: increase pebble test waitForServer attempts
  • 1b4c3d2 x509roots/fallback: update bundle
  • b903b53 acme: capture pebble test subprocess stdout/stderr
  • See full diff in compare view

Updates golang.org/x/net from 0.42.0 to 0.43.0

Commits
  • e74bc31 go.mod: update golang.org/x dependencies
  • af6926e http2: remove references to defunct http2.golang.org test server
  • See full diff in compare view

Updates google.golang.org/protobuf from 1.36.6 to 1.36.7

Updates github.com/libp2p/go-libp2p-pubsub from 0.14.1 to 0.14.2

Release notes

Sourced from github.com/libp2p/go-libp2p-pubsub's releases.

v0.14.2

What's Changed

Full Changelog: https://github.com/libp2p/go-libp2p-pubsub/compare/v0.14.1...v0.14.2

Commits

Updates github.com/multiformats/go-multiaddr from 0.16.0 to 0.16.1

Release notes

Sourced from github.com/multiformats/go-multiaddr's releases.

v0.16.1

What's Changed

Full Changelog: https://github.com/multiformats/go-multiaddr/compare/v0.16.0...v0.16.1

Commits

Updates github.com/spf13/pflag from 1.0.6 to 1.0.7

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.7

What's Changed

New Contributors

Full Changelog: https://github.com/spf13/pflag/compare/v1.0.6...v1.0.7

Commits
  • f9cbdd9 Merge pull request #348 from max-frank/add-time-flag-support
  • e3be2eb Reduce duplication by forwarding to sibling functions
  • 7cc25e3 Don't export TimeValue (yet)
  • d15848d Remove unnecessary time test stderr dev null redirect
  • c5ce22e Use time.Time for expectations in time flag tests
  • 1992c5a Add support for time.Time flags
  • 1c62fb2 Merge pull request #431 from LeGEC/430-fix-usage-message-for-func-flags
  • 1a4b5b2 fix discrepancy in order of arguments for Func() and BoolFunc() #433
  • 4730aa0 fix help message for Func and BoolFunc flags #430
  • f4c97c2 minor: fix typos in comments
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.40.0 to 0.41.0

Commits
  • ef5341b go.mod: update golang.org/x dependencies
  • b999374 acme: fix pebble subprocess output data race
  • c247dea x509roots/fallback: store bundle certs directly in DER
  • 1fda731 acme: increase pebble test waitForServer attempts
  • 1b4c3d2 x509roots/fallback: update bundle
  • b903b53 acme: capture pebble test subprocess stdout/stderr
  • See full diff in compare view

Updates golang.org/x/net from 0.42.0 to 0.43.0

Commits
  • e74bc31 go.mod: update golang.org/x dependencies
  • af6926e http2: remove references to defunct http2.golang.org test server
  • See full diff in compare view

Updates google.golang.org/protobuf from 1.36.6 to 1.36.7

Updates github.com/celestiaorg/go-square/v2 from 2.2.0 to 2.3.1

Release notes

Sourced from github.com/celestiaorg/go-square/v2's releases.

v2.3.1

What's Changed

Full Changelog: https://github.com/celestiaorg/go-square/compare/v2.3.0...v2.3.1

v2.3.1-rc0

What's Changed

Full Changelog: https://github.com/celestiaorg/go-square/compare/v2.3.0...v2.3.1-rc0

v2.3.0

What's Changed

New Contributors

Full Changelog: https://github.com/celestiaorg/go-square/compare/v2.2.0...v2.3.0

Commits
  • bdbb93c fix: ony the first share should parse the signer (#163)
  • 7aff1b2 docs(README): fix make benchmark command (#159)
  • fa33a54 feat: add revert functionality for Builder transactions and blob transactions...
  • a1064ea chore(deps): bump celestiaorg/.github from 0.5.0 to 0.6.1 (#148)
  • 8532f43 refactor: IsPowerOfTwo (#147)
  • 5539c0a chore(deps): bump github.com/celestiaorg/nmt from 0.22.2 to 0.23.0 (#131)
  • b1d4d33 chore: validate namespace via ValidateForData and ValidateForBlob (#145)
  • See full diff in compare view

Updates github.com/filecoin-project/go-jsonrpc from 0.7.1 to 0.8.0

Release notes

Sourced from github.com/filecoin-project/go-jsonrpc's releases.

v0.8.0

What's Changed

New Contributors

Full Changelog: https://github.com/filecoin-project/go-jsonrpc/compare/v0.7.1...v0.8.0

Commits
  • bbbae86 chore: v0.8.0 bump (#134)
  • e691565 feat: introduce MethodNameFormatter (#130)
  • 8e8f524 add options to set custom namespace separator and a method name transformer (...
  • 9d4c6fb chore!: bump go.mod to Go 1.23 and run go fix (#127)
  • See full diff in compare view

Updates github.com/rs/zerolog from 1.33.0 to 1.34.0

Commits
  • db9d1be Update go versions covered by CI
  • 5f4b880 Delete _config.yml
  • ffb2708 Remove CNAME file
  • cc4dde7 Create CONTRIBUTING.md
  • 04ea0f4 Implement Close() for zerolog.FilteredLevelWriter (#715)
  • 0398600 fix: reset condition in burst sampler (#711) (#712)
  • 1869fa5 FormatPartValueByName for flexible custom formatting for ConsoleWriter (#541)
  • 31e7995 remove unnecessary nil checks (#701)
  • 582f820 Get BasicSampler(0), RandomSampler(0), and BurstSampler(0) to behave the same...
  • 6abadab Bump github.com/rs/xid from 1.5.0 to 1.6.0 (#684)
  • See full diff in compare view

Updates google.golang.org/protobuf from 1.36.6 to 1.36.7

Updates github.com/celestiaorg/go-square/v2 from 2.2.0 to 2.3.1

Release notes

Sourced from github.com/celestiaorg/go-square/v2's releases.

v2.3.1

What's Changed

Full Changelog: https://github.com/celestiaorg/go-square/compare/v2.3.0...v2.3.1

v2.3.1-rc0

What's Changed

Full Changelog: https://github.com/celestiaorg/go-square/compare/v2.3.0...v2.3.1-rc0

v2.3.0

What's Changed

New Contributors

Full Changelog: https://github.com/celestiaorg/go-square/compare/v2.2.0...v2.3.0

Commits
  • bdbb93c fix: ony the first share should parse the signer (#163)
  • 7aff1b2 docs(README): fix make benchmark command (#159)
  • fa33a54 feat: add revert functionality for Builder transactions and blob transactions...
  • a1064ea chore(deps): bump celestiaorg/.github from 0.5.0 to 0.6.1 (#148)
  • 8532f43 refactor: IsPowerOfTwo (#147)
  • 5539c0a chore(deps): bump github.com/celestiaorg/nmt from 0.22.2 to 0.23.0 (#131)
  • b1d4d33 chore: validate namespace via ValidateForData and ValidateForBlob (#145)
  • See full diff in compare view

Updates github.com/filecoin-project/go-jsonrpc from 0.7.1 to 0.8.0

Release notes

Sourced from github.com/filecoin-project/go-jsonrpc's releases.

v0.8.0

What's Changed

New Contributors

Full Changelog: https://github.com/filecoin-project/go-jsonrpc/compare/v0.7.1...v0.8.0

Commits
  • bbbae86 chore: v0.8.0 bump (#134)
  • e691565 feat: introduce MethodNameFormatter (#130)
  • 8e8f524 add options to set custom namespace separator and a method name transformer (...
  • 9d4c6fb chore!: bump go.mod to Go 1.23 and run go fix (#127)
  • See full diff in compare view

Updates github.com/prometheus/client_golang from 1.20.5 to 1.23.0

Release notes

Sourced from

Commits:
1
Files Changed:
16
Additions:
+737
Deletions:
-710
Package Dependencies
Ecosystem:
go
Version Change:
0.40.0 → 0.41.0
Update Type:
Minor
Ecosystem:
go
Version Change:
0.42.0 → 0.43.0
Update Type:
Minor
Ecosystem:
go
Version Change:
1.36.6 → 1.36.7
Update Type:
Patch
Ecosystem:
go
Version Change:
1.0.6 → 1.0.7
Update Type:
Patch
Ecosystem:
go
Version Change:
0.16.0 → 0.16.1
Update Type:
Patch
Ecosystem:
go
Version Change:
0.6.6 → 0.7.0
Update Type:
Minor
Ecosystem:
go
Version Change:
0.14.1 → 0.14.2
Update Type:
Patch
Technical Details
ID: 4785615
UUID: 2730262322
Node ID: PR_kwDOFABrEc6ivH8y
Host: GitHub
Repository: evstack/ev-node
Merge State: Dirty