An open index of dependabot pull requests across open source projects.

build(deps): Bump the all-go group across 8 directories with 20 updates

Open
Number: #2548
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 2
Created: August 08, 2025 at 11:02 AM UTC
(10 months ago)
Updated: August 18, 2025 at 03:04 PM UTC
(10 months ago)
Labels:
T:dependencies
Description:

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.


Bumps the all-go group with 7 updates in the / directory:

Package From To
github.com/celestiaorg/go-header 0.6.6 0.7.0
github.com/libp2p/go-libp2p-pubsub 0.14.1 0.14.2
github.com/multiformats/go-multiaddr 0.16.0 0.16.1
github.com/spf13/pflag 1.0.6 1.0.7
golang.org/x/crypto 0.40.0 0.41.0
golang.org/x/net 0.42.0 0.43.0
google.golang.org/protobuf 1.36.6 1.36.7

Bumps the all-go group with 8 updates in the /apps/testapp directory:

Package From To
github.com/libp2p/go-libp2p-pubsub 0.14.1 0.14.2
github.com/multiformats/go-multiaddr 0.16.0 0.16.1
github.com/spf13/pflag 1.0.6 1.0.7
golang.org/x/crypto 0.40.0 0.41.0
golang.org/x/net 0.42.0 0.43.0
google.golang.org/protobuf 1.36.6 1.36.7
github.com/celestiaorg/go-square/v2 2.2.0 2.3.1
github.com/filecoin-project/go-jsonrpc 0.7.1 0.8.0

Bumps the all-go group with 4 updates in the /da directory: github.com/rs/zerolog, google.golang.org/protobuf, github.com/celestiaorg/go-square/v2 and github.com/filecoin-project/go-jsonrpc.
Bumps the all-go group with 5 updates in the /execution/evm directory:

Package From To
github.com/prometheus/client_golang 1.20.5 1.23.0
github.com/spf13/pflag 1.0.6 1.0.7
github.com/ethereum/go-ethereum 1.15.0 1.16.2
github.com/golang-jwt/jwt/v5 5.2.2 5.3.0
github.com/testcontainers/testcontainers-go/modules/compose 0.37.0 0.38.0

Bumps the all-go group with 2 updates in the /execution/grpc directory: golang.org/x/net and google.golang.org/protobuf.
Bumps the all-go group with 7 updates in the /sequencers/single directory:

Package From To
github.com/celestiaorg/go-header 0.6.6 0.7.0
github.com/libp2p/go-libp2p-pubsub 0.14.1 0.14.2
github.com/multiformats/go-multiaddr 0.16.0 0.16.1
github.com/spf13/pflag 1.0.6 1.0.7
golang.org/x/crypto 0.40.0 0.41.0
golang.org/x/net 0.42.0 0.43.0
google.golang.org/protobuf 1.36.6 1.36.7

Bumps the all-go group with 8 updates in the /test/docker-e2e directory:

Package From To
github.com/prometheus/client_golang 1.20.5 1.23.0
github.com/rs/zerolog 1.33.0 1.34.0
github.com/spf13/cobra 1.8.1 1.9.1
github.com/spf13/viper 1.19.0 1.20.1
google.golang.org/protobuf 1.36.6 1.36.7
github.com/celestiaorg/go-square/v2 2.2.0 2.3.1
cosmossdk.io/math 1.4.0 1.5.3
github.com/moby/moby 27.5.1+incompatible 28.3.3+incompatible

Bumps the all-go group with 10 updates in the /test/e2e directory:

Package From To
github.com/celestiaorg/go-header 0.6.6 0.7.0
github.com/libp2p/go-libp2p-pubsub 0.14.1 0.14.2
github.com/multiformats/go-multiaddr 0.16.0 0.16.1
github.com/spf13/pflag 1.0.6 1.0.7
golang.org/x/crypto 0.40.0 0.41.0
golang.org/x/net 0.42.0 0.43.0
google.golang.org/protobuf 1.36.6 1.36.7
github.com/ethereum/go-ethereum 1.15.0 1.16.2
github.com/golang-jwt/jwt/v5 5.2.2 5.3.0
github.com/testcontainers/testcontainers-go/modules/compose 0.37.0 0.38.0

Updates github.com/celestiaorg/go-header from 0.6.6 to 0.7.0

Release notes

Sourced from github.com/celestiaorg/go-header's releases.

v0.7.0

v0.7.0 release brings high-performance dynamic Tail maintenance for Syncer, also known as header pruning.

Notable Changes

Syncer

These new fields were introduced to Syncer's config:

        // PruningWindow defines the duration within which headers are retained before being pruned.
        // Default is 337 hours.
	PruningWindow time.Duration
	// SyncFromHash is the hash of the header from which Syncer should start syncing.
	// Zero value to disable. Value updates up and down the chain are gracefully handled by Syncer.
	//
	// By default, Syncer maintains PruningWindow number of headers. SyncFromHash overrides this default,
	// allowing any user to specify a custom starting point.
	//
	// SyncFromHash has higher priority than SyncFromHeight.
	SyncFromHash string
	// SyncFromHeight is the height of the header from which Syncer should start syncing.
	// Zero value to disable. Value updates up and down the chain are gracefully handled by Syncer.
	//
	// By default, Syncer maintains PruningWindow number of headers. SyncFromHeight overrides this default,
	// allowing any user to specify a custom starting point.
	//
	// SyncFromHeight has lower priority than SyncFromHash.
	SyncFromHeight uint64

Store

  • store.Store.DeleteTo method (celestiaorg/go-header#275)
  • store.Store.OnDelete method, which allows users to register individual header deletion handlers. This will enable users to execute farewell logic when headers are removed, e.g., cleanup data committed in the header but stored separately. (celestiaorg/go-header#320)
  • Unsafe store recovery tools (celestiaorg/go-header#325)

Breaks

  • store.Store.Init and store.Init were removed. Initialization is now performed lazily using the first header given to store.Append (celestiaorg/go-header#274)

What's Changed

... (truncated)

Commits

Updates github.com/libp2p/go-libp2p from 0.41.1 to 0.42.0

Release notes

Sourced from github.com/libp2p/go-libp2p's releases.

v0.42.0

⚠ Breaking Changes

Added a new method, VerifySourceAddress(net.Addr) bool, to the Resource Manager interface. For more details see the Source Address Verification section.

For custom implementation which want to opt out of Source Address Verification and keep the existing behavior, return false from the method.

🔦 Highlights

Per Address Reachability via AutoNAT v2

libp2p hosts can now determine reachability for individual addresses using AutoNATV2. To opt in to reachability checking use the EnableAutoNATV2 libp2p option. Using this nodes can now determine their IPv4, IPv6, and browser address reachability separately. In a future release, AutoRelay will use this information and make appropriate relay reservations accordingly. https://pkg.go.dev/github.com/libp2p/go-libp2p#EnableAutoNATv2

To query addresses by their reachability, ConfirmedAddrs() (reachable, unreachable, unknown []ma.Multiaddr) that provides Reachability information per host address. https://pkg.go.dev/github.com/libp2p/go-libp2p/p2p/host/basic#BasicHost.ConfirmedAddrs For notifications, Subscribe to the event event.EvtHostReachableAddrsChanged https://pkg.go.dev/github.com/libp2p/go-libp2p/core/event#EvtHostReachableAddrsChanged

Rate Limiting

We've introduced the package github.com/libp2p/go-libp2p/x/rate for rate limiting. The struct rate.Limiter provides Global, Network Specific, and Subnet Specific rate limiting. The Subnet specific rate limits allows for better DoS Protection by rate limiting malicious IPs. https://pkg.go.dev/github.com/libp2p/go-libp2p/x/rate

Use Limit(f func(s network.Stream)) func(s network.Stream) on Limiter to limit specific stream handlers. For example, within libp2p, the Identify Service uses this as ids.Host.SetStreamHandler(IDPush, ids.rateLimiter.Limit(ids.handlePush)) to rate limit the number of times peers can perform identify push.

For non Stream use cases use the Allow(ip) method on the limiter.

Connection Rate Limiting

New connection requests are now rate limited per IP. By default we allow 1 connection every 5 seconds from an IP address with a burst of 16 connections per IP. The burst is high enough that this should only block malicious peers.

To configure the connection rate limits, use the WithConnRateLimiters option on the Resource Manager. https://pkg.go.dev/github.com/libp2p/go-libp2p/p2p/host/resource-manager#WithConnRateLimiters

Source Address Verification for QUIC

This release introduces Source Address Verification for QUIC, preventing DoS attacks by spoofing IP addresses. See: https://www.rfc-editor.org/rfc/rfc9000.html#section-8 for details.

We are now gating incoming QUIC connections before the handshake is started. This further improves DoS protection by not wasting CPU on handshaking QUIC connections which would have been dropped by the Resource Manager.

Other changes

  • WebRTC Direct peers can now send messages of up to 256 kB (see spec: libp2p/specs#628)
  • Refactored the addressing code within BasicHost and moved it into Address Manager. In a future release, this will be exposed to users with an improved Address API for the libp2p Host.

What's Changed

... (truncated)

Commits

Updates github.com/libp2p/go-libp2p-pubsub from 0.14.1 to 0.14.2

Release notes

Sourced from github.com/libp2p/go-libp2p-pubsub's releases.

v0.14.2

What's Changed

Full Changelog: https://github.com/libp2p/go-libp2p-pubsub/compare/v0.14.1...v0.14.2

Commits

Updates github.com/multiformats/go-multiaddr from 0.16.0 to 0.16.1

Release notes

Sourced from github.com/multiformats/go-multiaddr's releases.

v0.16.1

What's Changed

Full Changelog: https://github.com/multiformats/go-multiaddr/compare/v0.16.0...v0.16.1

Commits

Updates github.com/spf13/pflag from 1.0.6 to 1.0.7

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.7

What's Changed

New Contributors

Full Changelog: https://github.com/spf13/pflag/compare/v1.0.6...v1.0.7

Commits
  • f9cbdd9 Merge pull request #348 from max-frank/add-time-flag-support
  • e3be2eb Reduce duplication by forwarding to sibling functions
  • 7cc25e3 Don't export TimeValue (yet)
  • d15848d Remove unnecessary time test stderr dev null redirect
  • c5ce22e Use time.Time for expectations in time flag tests
  • 1992c5a Add support for time.Time flags
  • 1c62fb2 Merge pull request #431 from LeGEC/430-fix-usage-message-for-func-flags
  • 1a4b5b2 fix discrepancy in order of arguments for Func() and BoolFunc() #433
  • 4730aa0 fix help message for Func and BoolFunc flags #430
  • f4c97c2 minor: fix typos in comments
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.40.0 to 0.41.0

Commits
  • ef5341b go.mod: update golang.org/x dependencies
  • b999374 acme: fix pebble subprocess output data race
  • c247dea x509roots/fallback: store bundle certs directly in DER
  • 1fda731 acme: increase pebble test waitForServer attempts
  • 1b4c3d2 x509roots/fallback: update bundle
  • b903b53 acme: capture pebble test subprocess stdout/stderr
  • See full diff in compare view

Updates golang.org/x/net from 0.42.0 to 0.43.0

Commits
  • e74bc31 go.mod: update golang.org/x dependencies
  • af6926e http2: remove references to defunct http2.golang.org test server
  • See full diff in compare view

Updates google.golang.org/protobuf from 1.36.6 to 1.36.7

Updates golang.org/x/net from 0.42.0 to 0.43.0

Commits
  • e74bc31 go.mod: update golang.org/x dependencies
  • af6926e http2: remove references to defunct http2.golang.org test server
  • See full diff in compare view

Updates google.golang.org/protobuf from 1.36.6 to 1.36.7

Updates google.golang.org/protobuf from 1.36.6 to 1.36.7

Updates github.com/libp2p/go-libp2p from 0.41.1 to 0.42.0

Release notes

Sourced from github.com/libp2p/go-libp2p's releases.

v0.42.0

⚠ Breaking Changes

Added a new method, VerifySourceAddress(net.Addr) bool, to the Resource Manager interface. For more details see the Source Address Verification section.

For custom implementation which want to opt out of Source Address Verification and keep the existing behavior, return false from the method.

🔦 Highlights

Per Address Reachability via AutoNAT v2

libp2p hosts can now determine reachability for individual addresses using AutoNATV2. To opt in to reachability checking use the EnableAutoNATV2 libp2p option. Using this nodes can now determine their IPv4, IPv6, and browser address reachability separately. In a future release, AutoRelay will use this information and make appropriate relay reservations accordingly. https://pkg.go.dev/github.com/libp2p/go-libp2p#EnableAutoNATv2

To query addresses by their reachability, ConfirmedAddrs() (reachable, unreachable, unknown []ma.Multiaddr) that provides Reachability information per host address. https://pkg.go.dev/github.com/libp2p/go-libp2p/p2p/host/basic#BasicHost.ConfirmedAddrs For notifications, Subscribe to the event event.EvtHostReachableAddrsChanged https://pkg.go.dev/github.com/libp2p/go-libp2p/core/event#EvtHostReachableAddrsChanged

Rate Limiting

We've introduced the package github.com/libp2p/go-libp2p/x/rate for rate limiting. The struct rate.Limiter provides Global, Network Specific, and Subnet Specific rate limiting. The Subnet specific rate limits allows for better DoS Protection by rate limiting malicious IPs. https://pkg.go.dev/github.com/libp2p/go-libp2p/x/rate

Use Limit(f func(s network.Stream)) func(s network.Stream) on Limiter to limit specific stream handlers. For example, within libp2p, the Identify Service uses this as ids.Host.SetStreamHandler(IDPush, ids.rateLimiter.Limit(ids.handlePush)) to rate limit the number of times peers can perform identify push.

For non Stream use cases use the Allow(ip) method on the limiter.

Connection Rate Limiting

New connection requests are now rate limited per IP. By default we allow 1 connection every 5 seconds from an IP address with a burst of 16 connections per IP. The burst is high enough that this should only block malicious peers.

To configure the connection rate limits, use the WithConnRateLimiters option on the Resource Manager. https://pkg.go.dev/github.com/libp2p/go-libp2p/p2p/host/resource-manager#WithConnRateLimiters

Source Address Verification for QUIC

This release introduces Source Address Verification for QUIC, preventing DoS attacks by spoofing IP addresses. See: https://www.rfc-editor.org/rfc/rfc9000.html#section-8 for details.

We are now gating incoming QUIC connections before the handshake is started. This further improves DoS protection by not wasting CPU on handshaking QUIC connections which would have been dropped by the Resource Manager.

Other changes

  • WebRTC Direct peers can now send messages of up to 256 kB (see spec: libp2p/specs#628)
  • Refactored the addressing code within BasicHost and moved it into Address Manager. In a future release, this will be exposed to users with an improved Address API for the libp2p Host.

What's Changed

... (truncated)

Commits

Updates github.com/libp2p/go-libp2p-pubsub from 0.14.1 to 0.14.2

Release notes

Sourced from github.com/libp2p/go-libp2p-pubsub's releases.

v0.14.2

What's Changed

Full Changelog: https://github.com/libp2p/go-libp2p-pubsub/compare/v0.14.1...v0.14.2

Commits

Updates github.com/multiformats/go-multiaddr from 0.16.0 to 0.16.1

Release notes

Sourced from github.com/multiformats/go-multiaddr's releases.

v0.16.1

What's Changed

Full Changelog: https://github.com/multiformats/go-multiaddr/compare/v0.16.0...v0.16.1

Commits

Updates github.com/spf13/pflag from 1.0.6 to 1.0.7

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.7

What's Changed

New Contributors

Full Changelog: https://github.com/spf13/pflag/compare/v1.0.6...v1.0.7

Commits
  • f9cbdd9 Merge pull request #348 from max-frank/add-time-flag-support
  • e3be2eb Reduce duplication by forwarding to sibling functions
  • 7cc25e3 Don't export TimeValue (yet)
  • d15848d Remove unnecessary time test stderr dev null redirect
  • c5ce22e Use time.Time for expectations in time flag tests
  • 1992c5a Add support for time.Time flags
  • 1c62fb2 Merge pull request #431 from LeGEC/430-fix-usage-message-for-func-flags
  • 1a4b5b2 fix discrepancy in order of arguments for Func() and BoolFunc() #433
  • 4730aa0 fix help message for Func and BoolFunc flags #430
  • f4c97c2 minor: fix typos in comments
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.40.0 to 0.41.0

Commits
  • ef5341b go.mod: update golang.org/x dependencies
  • b999374 acme: fix pebble subprocess output data race
  • c247dea x509roots/fallback: store bundle certs directly in DER
  • 1fda731 acme: increase pebble test waitForServer attempts
  • 1b4c3d2 x509roots/fallback: update bundle
  • b903b53 acme: capture pebble test subprocess stdout/stderr
  • See full diff in compare view

Updates golang.org/x/net from 0.42.0 to 0.43.0

Commits
  • e74bc31 go.mod: update golang.org/x dependencies
  • af6926e http2: remove references to defunct http2.golang.org test server
  • See full diff in compare view

Updates google.golang.org/protobuf from 1.36.6 to 1.36.7

Updates github.com/celestiaorg/go-square/v2 from 2.2.0 to 2.3.1

Release notes

Sourced from github.com/celestiaorg/go-square/v2's releases.

v2.3.1

What's Changed

Full Changelog: https://github.com/celestiaorg/go-square/compare/v2.3.0...v2.3.1

v2.3.1-rc0

What's Changed

Full Changelog: https://github.com/celestiaorg/go-square/compare/v2.3.0...v2.3.1-rc0

v2.3.0

What's Changed

New Contributors

Full Changelog: https://github.com/celestiaorg/go-square/compare/v2.2.0...v2.3.0

Commits
  • bdbb93c fix: ony the first share should parse the signer (#163)
  • 7aff1b2 docs(README): fix make benchmark command (#159)
  • fa33a54 feat: add revert functionality for Builder transactions and blob transactions...
  • a1064ea chore(deps): bump celestiaorg/.github from 0.5.0 to 0.6.1 (#148)
  • 8532f43 refactor: IsPowerOfTwo (#147)
  • 5539c0a chore(deps): bump github.com/celestiaorg/nmt from 0.22.2 to 0.23.0 (#131)
  • b1d4d33 chore: validate namespace via ValidateForData and ValidateForBlob (#145)
  • See full diff in compare view

Updates github.com/filecoin-project/go-jsonrpc from 0.7.1 to 0.8.0

Release notes

Sourced from github.com/filecoin-project/go-jsonrpc's releases.

v0.8.0

What's Changed

New Contributors

Full Changelog: https://github.com/filecoin-project/go-jsonrpc/compare/v0.7.1...v0.8.0

Commits
  • bbbae86 chore: v0.8.0 bump (#134)
  • e691565 feat: introduce MethodNameFormatter (#130)
  • 8e8f524 add options to set custom namespace separator and a method name transformer (...
  • 9d4c6fb chore!: bump go.mod to Go 1.23 and run go fix (#127)
  • See full diff in compare view

Updates golang.org/x/net from 0.42.0 to 0.43.0

Commits
  • e74bc31 go.mod: update golang.org/x dependencies
  • af6926e http2: remove references to defunct http2.golang.org test server
  • See full diff in compare view

Updates google.golang.org/protobuf from 1.36.6 to 1.36.7

Updates google.golang.org/protobuf from 1.36.6 to 1.36.7

Updates github.com/celestiaorg/go-square/v2 from 2.2.0 to 2.3.1

Release notes

Sourced from github.com/celestiaorg/go-square/v2's releases.

v2.3.1

What's Changed

Full Changelog: htt...

Description has been truncated

Pull Request Statistics
Commits:
0
Files Changed:
0
Additions:
+0
Deletions:
-0
Package Dependencies
Ecosystem:
go
Version Change:
0.40.0 → 0.41.0
Update Type:
Minor
Ecosystem:
go
Version Change:
0.42.0 → 0.43.0
Update Type:
Minor
Ecosystem:
go
Version Change:
1.36.6 → 1.36.7
Update Type:
Patch
Ecosystem:
go
Version Change:
1.0.6 → 1.0.7
Update Type:
Patch
Ecosystem:
go
Version Change:
0.16.0 → 0.16.1
Update Type:
Patch
Ecosystem:
go
Version Change:
0.6.6 → 0.7.0
Update Type:
Minor
Ecosystem:
go
Version Change:
0.14.1 → 0.14.2
Update Type:
Patch
Technical Details
ID: 5289506
UUID: 3303616287
Node ID: PR_kwDOFABrEc6ivqPg
Host: GitHub
Repository: evstack/ev-node