chore(deps): bump the go-minor-and-patch group with 22 updates

Closed
DE
4mo ago
+191-188

Bumps the go-minor-and-patch group with 22 updates:

PackageFromTo
github.com/aws/aws-sdk-go-v21.41.111.41.12
github.com/aws/aws-sdk-go-v2/config1.32.221.32.23
github.com/aws/aws-sdk-go-v2/credentials1.19.211.19.22
github.com/aws/aws-sdk-go-v2/service/secretsmanager1.42.11.42.2
github.com/aws/aws-sdk-go-v2/service/sso1.31.11.31.2
github.com/aws/smithy-go1.27.01.27.1
github.com/testcontainers/testcontainers-go0.40.00.42.0
google.golang.org/api0.280.00.283.0
github.com/Azure/azure-sdk-for-go/sdk/azcore1.21.11.22.0
github.com/aws/aws-sdk-go-v2/feature/s3/manager1.22.241.22.25
github.com/aws/aws-sdk-go-v2/service/s31.103.11.103.2
github.com/nats-io/nats.go1.51.01.52.0
github.com/open-policy-agent/opa1.17.01.17.1
github.com/sigstore/cosign/v33.0.63.1.0
go.step.sm/crypto0.81.00.82.0
google.golang.org/genproto/googleapis/bytestream0.0.0-20260511170946-3700d4141b600.0.0-20260523011958-0a33c5d7ca68
github.com/vektah/gqlparser/v22.5.332.5.34
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc0.67.00.68.0
github.com/aws/aws-sdk-go-v2/service/sts1.43.11.43.2
github.com/minio/minio-go/v77.0.987.2.0
golang.org/x/sync0.20.00.21.0
k8s.io/apimachinery0.35.30.36.1

Updates github.com/aws/aws-sdk-go-v2 from 1.41.11 to 1.41.12

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.22 to 1.32.23

Commits

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.19.21 to 1.19.22

Commits

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.42.1 to 1.42.2

Commits

Updates github.com/aws/aws-sdk-go-v2/service/sso from 1.31.1 to 1.31.2

Commits

Updates github.com/aws/smithy-go from 1.27.0 to 1.27.1

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-06-05)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.27.2
    • Bug Fix: Fix incorrect serialization of unions in CBOR-based protocols.

Release (2026-06-04)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.27.1
    • Bug Fix: Fixed a deserialization failure in all protocols when encountering a union with explicit null members.
    • Bug Fix: Fixed a panic when deserializing nested unions in JSON- and CBOR-based protocols.

Release (2026-06-02)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.27.0
    • Feature: Add APIs for schema-based serialization.
    • Feature: Add support for all current AWS and Smithy protocols.
    • Bug Fix: Enforce max nesting depth of 128 on CBOR payloads.
  • github.com/aws/smithy-go/aws-http-auth: v1.2.0
    • Feature: Add event stream signer.

Release (2026-05-27)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.26.0
    • Feature: Add StringSlice to endpoint rulesfn.

Release (2026-04-23)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.25.1
    • Bug Fix: Fixed a memory leak in the LRU cache implementation used by some AWS services.

... (truncated)

Commits

Updates github.com/testcontainers/testcontainers-go from 0.40.0 to 0.42.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.42.0

What's Changed

⚠️ Breaking Changes

🔒 Security

🐛 Bug Fixes

  • fix: return an error when docker host cannot be retrieved (#3613) @​ash2k

🧹 Housekeeping

📦 Dependency updates

  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.28.0 to 1.43.0 in /modules/grafana-lgtm (#3639) @dependabot[bot]
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 in /modules/compose (#3641) @dependabot[bot]
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 in /modules/compose (#3645) @dependabot[bot]
  • chore(deps): bump mkdocs-include-markdown-plugin from 7.2.1 to 7.2.2 (#3626) @dependabot[bot]
  • chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.51.2 to 1.97.3 in /modules/localstack (#3638) @dependabot[bot]
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.41.0 to 1.43.0 in /modules/grafana-lgtm (#3643) @dependabot[bot]
  • chore(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to 1.43.0 in /modules/milvus (#3644) @dependabot[bot]
  • chore: update to Go 1.25.9, 1.26.9 (#3647) @​thaJeztah
  • chore(deps): bump bump github.com/klauspost/compress v1.18.5, github.com/docker/compose v5.1.2 (#3646) @​thaJeztah
  • chore(deps): bump moby/client v0.4.0, moby/api v1.54.1 (#3634) @​thaJeztah
  • chore(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 (#3629) @dependabot[bot]
  • chore(deps): bump github.com/moby/patternmatcher from 0.6.0 to 0.6.1 (#3628) @dependabot[bot]
  • chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.2 to 4.26.3 (#3627) @dependabot[bot]
  • fix(localstack): accept community-archive as a valid tag (#3601) @​johnduhart
  • chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in /modules/gcloud (#3632) @dependabot[bot]
  • chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#3625) @dependabot[bot]
  • chore(deps): bump pygments from 2.19.2 to 2.20.0 (#3615) @dependabot[bot]
  • chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in /modules/milvus (#3612) @dependabot[bot]
  • chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in /modules/etcd (#3611) @dependabot[bot]
  • chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /modules/ollama (#3610) @dependabot[bot]
  • chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in /modules/pinecone (#3609) @dependabot[bot]
  • chore(deps): bump google.golang.org/grpc from 1.67.0 to 1.79.3 in /modules/couchbase (#3608) @dependabot[bot]
  • chore(deps): bump requests from 2.32.4 to 2.33.0 (#3604) @dependabot[bot]
  • chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /modules/meilisearch (#3607) @dependabot[bot]
  • chore(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.1 in /modules/compose (#3605) @dependabot[bot]

... (truncated)

Commits
  • 6e58418 chore: use new version (v0.42.0) in modules and examples
  • f713dc0 chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetr...
  • 300827a chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetr...
  • 7a15ac1 chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace...
  • 5bae3d2 fix: return an error when docker host cannot be retrieved (#3613)
  • fc19484 chore(deps): bump mkdocs-include-markdown-plugin from 7.2.1 to 7.2.2 (#3626)
  • 95bdc0c chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#3638)
  • 75aa226 chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptrace...
  • 2f59938 chore(deps): bump go.opentelemetry.io/otel/sdk in /modules/milvus (#3644)
  • 580abf6 chore: update to Go 1.25.9, 1.26.9 (#3647)
  • Additional commits viewable in compare view

Updates google.golang.org/api from 0.280.0 to 0.283.0

Release notes

Sourced from google.golang.org/api's releases.

v0.283.0

0.283.0 (2026-06-01)

Features

v0.282.0

0.282.0 (2026-05-27)

Features

v0.281.0

0.281.0 (2026-05-26)

Features

Changelog

Sourced from google.golang.org/api's changelog.

0.283.0 (2026-06-01)

Features

0.282.0 (2026-05-27)

Features

0.281.0 (2026-05-26)

Features

Commits

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.21.1 to 1.22.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.22.0

1.22.0 (2026-06-04)

Features Added

  • Added type datetime.RFC7231 for date/time values in RFC 1123 format with a fixed GMT timezone.

Other Changes

  • Upgraded dependencies.
Commits
  • a19f613 Prep azcore@v1.22.0 for release (#26926)
  • 5803c0e Increment package version after release of storage/azblob (#26935) (#26943)
  • 9a979ff [Automation] Regenerate SDK based on typespec-go branch main 【batch 6】 (#26939)
  • 711094d eng/tools/generator: release v0.4.14 (#26934)
  • 20bd677 Deprecate Change Analysis SDK (#26913)
  • 92a31ec [Automation] Regenerate SDK based on typespec-go branch main 【batch 5】 (#26932)
  • 768459d azcertificates: live recording for PlatformManaged + review fixes (follow-up ...
  • e845f72 Update codeowners (#26918)
  • 118bb35 eng/tools/internal/exports: handle untyped const with selector expr value (#2...
  • 2b3767b Configurations: 'specification/containerservice/resource-manager/Microsoft.C...
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/s3/manager from 1.22.24 to 1.22.25

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.103.1 to 1.103.2

Commits

Updates github.com/nats-io/nats.go from 1.51.0 to 1.52.0

Release notes

Sourced from github.com/nats-io/nats.go's releases.

Release v1.52.0

Changelog

This release focuses on 2.14 nats-server features support.

ADDED

  • JetStream:
    • Added fast batch stream config field (#2052)
    • Added message scheduling headers and publish opts (#2051)
    • Updated StreamConfig with Consumer field and added AckFlowControlPolicy (#2070)
    • Added reset consumer API (#2069)

FIXED

  • Core NATS:
    • Fix Subscription.StatusChanged channel closure on Closed Subscription. Thanks @​nithimani38-prog for the contribution (#2034)

IMPROVED

  • Fixed Flaky JS cluster tests (#2062)

Complete Changes

https://github.com/nats-io/nats.go/compare/v1.51.0...v1.52.0

Commits
  • e9f2a36 Release v1.52.0 (#2074)
  • 609274f [FIXED] Subscription.StatusChanged channel closure on Closed Subscription (#2...
  • f7cde74 [IMPROVED] Use latest release build for badge in README (#2064)
  • c7476ea [IMPROVED] Reject empty consumer info in CONSUMER.RESET response (#2072)
  • 8fde36f [ADDED] ResetConsumer JetStream API (#2069)
  • dcfd0fc [ADDED] StreamSource.Consumer config field and AckFlowControlPolicy (#2070)
  • 7a28503 [ADDED] Publish options and consts for message scheduling (#2051)
  • 6c91a51 [ADDED] AllowBatchPublish stream config field (#2052)
  • a614d0b [FIXED] Flaky JS cluster tests due to race in setupJSClusterWithSize (#2062)
  • See full diff in compare view

Updates github.com/open-policy-agent/opa from 1.17.0 to 1.17.1

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.17.1

This release uses the latest version of Go (1.26.4) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

It is otherwise the same code as v1.17.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

  • build: bump go 1.26.3 -> 1.26.4 (authored by @​srenatus)
Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.17.1

This release uses the latest version of Go (1.26.4) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

It is otherwise the same code as v1.17.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

  • build: bump go 1.26.3 -> 1.26.4 (authored by @​srenatus)
Commits

Updates github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.0

Changelog

Sourced from github.com/sigstore/cosign/v3's changelog.

v3.0.5

Deprecations

  • Deprecate rekor-entry-type flag (#4691)
  • Deprecate cosign triangulate (#4676)
  • Deprecate cosign copy (#4681)

Features

  • Automatically require signed timestamp with Rekor v2 entries (#4666)
  • Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
  • Add mTLS support for TSA client connections when signing with a signing config (#4620)
  • Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)

Bug Fixes

  • Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
  • fix: avoid panic on malformed attestation payload (#4651)
  • fix: avoid panic on malformed tlog entries (#4649)
  • fix: avoid panic on malformed replace payload (#4653)
  • Gracefully fail if bundle payload body is not a string (#4648)
  • Verify validity of chain rather than just certificate (#4663)
  • fix: avoid panic on malformed tlog entry body (#4652)

Documentation

  • docs(cosign): clarify RFC3161 revocation semantics (#4642)
  • Fix typo in CLI help (#4701)

v3.0.4

v3.0.4 resolves https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m.

Changes

  • Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (#4623)
  • Optimize cosign tree performance by caching digest resolution (#4612)
  • Don't require a trusted root to verify offline with a key (#4613)
  • Support default services for trusted-root and signing-config creation (#4592)

v2.6.2

v2.6.2 resolves https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m.

Changes

  • Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (#4624)
  • bump sigstore deps to resolve build errors (#4619)

... (truncated)

Commits
  • d253adf chore(deps): bump the gomod group across 1 directory with 2 updates (#4919)
  • c7b6253 test(e2e): cover Rekor v2 hashedrekord behavior (#4916)
  • 6115844 Update sigstore-go to v1.2.0 (#4914)
  • 0008f0e fix(verify): copy CheckOpts inside VerifyNewBundle to fix data race (#4917)
  • 5e053b3 fix(verify): Attach provided certificate and chain to loaded signature (#4737)
  • 0add3b5 Remove docstring references to deprecated flags (#4910)
  • ceeb6f4 Add staging support to conformance testing
  • 8cedfde Deprecate subcommands (#4894)
  • 8f34218 verify: return TUF errors for new bundle trusted roots
  • 4594450 chore(deps): bump k8s.io/client-go from 0.35.3 to 0.36.1 (#4858)
  • Additional commits viewable in compare view

Updates go.step.sm/crypto from 0.81.0 to 0.82.0

Release notes

Sourced from go.step.sm/crypto's releases.

Release v0.82.0

What's Changed

Dependencies:

Full Changelog: https://github.com/smallstep/crypto/compare/v0.81.1...v0.82.0

Release v0.81.1

What's Changed

Dependencies

New Contributors

Full Changelog: https://github.com/smallstep/crypto/compare/v0.81.0...v0.81.1

Commits
  • 444dcf9 Merge pull request #1021 from smallstep/feat/add-tpm-key-scope
  • 7f2cd29 Change 'direct' openOption to 'useGoTPM'
  • 563866c Merge pull request #1045 from smallstep/dependabot/go_modules/google.golang.o...
  • fef78a2 Add 'direct' to openOptions for using underlying TPM channel
  • 6482423 chore(deps): Bump google.golang.org/api from 0.280.0 to 0.283.0
  • 3a18890 Merge pull request #1044 from smallstep/dependabot/go_modules/modernc.org/sql...
  • e7a5f7a chore(deps): Bump modernc.org/sqlite from 1.50.1 to 1.51.0
  • 83e8bea Merge pull request #1043 from smallstep/dependabot/go_modules/github.com/aws/...
  • 5936626 chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms
  • a17441d Merge pull request #1046 from smallstep/dependabot/go_modules/github.com/aws/...
  • Additional commits viewable in compare view

Updates google.golang.org/genproto/googleapis/bytestream from 0.0.0-20260511170946-3700d4141b60 to 0.0.0-20260523011958-0a33c5d7ca68

Commits

Updates github.com/vektah/gqlparser/v2 from 2.5.33 to 2.5.34

Release notes

Sourced from github.com/vektah/gqlparser/v2's releases.

v2.5.34

What's Changed

New Contributors