build(deps): bump the gomod-minor-patch group across 1 directory with 10 updates

[dependabot]

Bumps the gomod-minor-patch group with 10 updates in the / directory:

Package	From	To
github.com/cosmos/ibc-go/v11	11.1.0	11.2.0
github.com/hashicorp/go-metrics	0.6.0	0.7.0
github.com/onsi/ginkgo/v2	2.32.0	2.33.0
github.com/onsi/gomega	1.42.1	1.43.1
github.com/stretchr/testify	1.11.1	1.12.1
golang.org/x/net	0.56.0	0.58.0
golang.org/x/sync	0.21.0	0.22.0
golang.org/x/text	0.38.0	0.41.0
google.golang.org/grpc	1.82.1	1.84.0
google.golang.org/protobuf	1.36.11	1.36.12

Updates github.com/cosmos/ibc-go/v11 from 11.1.0 to 11.2.0

Release notes

Sourced from github.com/cosmos/ibc-go/v11's releases.

v11.2.0

Description

This release introduces rate limiting middleware (moved from ibc-apps) and includes several validation, dependency updates, and fixes. For a complete list of updates, see the sections below.

New Features

Rate Limiting Middleware

This release adds the IBC rate-limiting middleware, migrated from ibc-apps. It applies configurable per-channel, per-denomination quotas to ICS-20 transfers and supports both IBC v1 and IBC v2.

The middleware tracks packet flow across sends, receives, acknowledgements, timeouts, and asynchronous acknowledgements to ensure accurate quota accounting. Rate limits can be managed through governance, queried over gRPC and CLI, and are initialized through genesis.

What's Changed

• feat(ratelimit): backport of ratelimit to v11 by @​srdtrk in cosmos/ibc-go#8991
• style(ratelimit)!: fix typos (backport #8994) by @​mergify[bot] in cosmos/ibc-go#8995
• docs: update changelog ahead of v11.2.0 release by @​srdtrk in cosmos/ibc-go#8997

Full Changelog: cosmos/ibc-go@v11.1.0...v11.2.0

Changelog

Sourced from github.com/cosmos/ibc-go/v11's changelog.

v11.2.0 - 2026-07-15

Features

• (apps/rate-limiting) #8991 feat: rate limiting middleware. (backport of #8268)

Improvements

• (apps/rate-limiting) #8995 style(ratelimit)!: fix typos (backport of #8994)

Commits

• cfc072e docs: update changelog ahead of release (#8997)
• f6f3283 style(ratelimit): fix typos (backport #8994) (#8995)
• bf74b47 feat(ratelimit): backport of ratelimit to v11 (#8991)
• f007cb3 chore(light-clients/08-wasm): add local pin back (#8960)
• 2827072 chore(light-clients/08-wasm): removed local pin of ibc-go (#8957)
• See full diff in compare view

Updates github.com/hashicorp/go-metrics from 0.6.0 to 0.7.0

Release notes

Sourced from github.com/hashicorp/go-metrics's releases.

v0.7.0

What's Changed

This release removes the long-standing compatibiltiy shim between hashicorp/go-metrics and armon/go-metrics. You no longer need to set build tags when consuming this library. If you have other libraries that consume this library, you should upgrade them at the same time as your application.

Full Changelog: hashicorp/go-metrics@v0.6.1...v0.7.0

v0.6.1

What's Changed

• Added NewStatsdSinkWithLogger and NewStatsiteSinkWithLogger functions to allow passing a logger to capture errors. hashicorp/go-metrics#217
• Updated prometheus client library hashicorp/go-metrics#215

Full Changelog: hashicorp/go-metrics@v0.6.0...v0.6.1

Commits

• 5a9e5ca build: remove compatibility shim (#222)
• 4655852 [chore] : Bump the go group across 1 directory with 2 updates (#221)
• 23523bc docs: Add contributing guide and LLM PR template link. (#220)
• 82bded6 [chore] : Bump google.golang.org/protobuf (#219)
• ba58708 VAULT-48025: fixing telemetry statsd/statsite sink and formatting errors (#217)
• 0f8560f [chore] : Bump the go group across 1 directory with 2 updates (#215)
• f7b3292 [chore] : Bump actions/checkout from 7.0.0 to 7.0.1 in the actions group (#216)
• 96fa24e [chore] : Bump actions/setup-go from 6.5.0 to 7.0.0 in the actions group (#214)
• 110cec7 [chore] : Bump github.com/prometheus/common (#213)
• 409c090 [chore] : Bump golangci/golangci-lint-action in the actions group (#212)
• Additional commits viewable in compare view

Updates github.com/onsi/ginkgo/v2 from 2.32.0 to 2.33.0

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.33.0

Features

• The JUnit reporter now records each spec's ReportEntrys as <properties> on its <testcase> element, with the entry's name and its JSON-encoded value. Thanks @​pohly! [23db51a]

Maintenance

• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. See RELEASING.md. [8616ecb]

v2.32.2

2.32.2

Fixes

• fix bug where ginkgo -race -p was taking extra long to exit [c6792b0]

v2.32.1

2.32.1

Fixes

• Defer AfterAll until repeated spec completes [e647b3b]

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.33.0

Features

• The JUnit reporter now records each spec's ReportEntrys as <properties> on its <testcase> element, with the entry's name and its JSON-encoded value. Thanks @​pohly! [23db51a]

Maintenance

• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. See RELEASING.md. [8616ecb]

2.32.2

Fixes

• fix bug where ginkgo -race -p was taking extra long to exit [c6792b0]

2.32.1

Fixes

• Defer AfterAll until repeated spec completes [e647b3b]

Commits

• 9f94149 v2.33.0
• db78e1b changelog: entries for the JUnit ReportEntry support and the release flow
• 8616ecb ci: release from a single workflow_dispatch button
• d8d9cdd README: add a sponsor badge
• ac70da6 README: dark-mode logo and a docs badge
• 23db51a junit: support ReportEntry
• b9e3bdd v2.32.2
• c6792b0 fix bug where ginkgo -race -p was taking extra long to exit
• f2d0f65 v2.32.1
• e647b3b Defer AfterAll until repeated spec completes
• Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.42.1 to 1.43.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.43.1

Maintenance

• Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]

v1.43.0

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.43.1

Maintenance

• Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Commits

• 1fca5c2 v1.43.1
• 47f0f87 v1.43.1 (full)
• be53601 changelog: entries for the yaml bump and the release flow
• e06b67c fix(ci): strip the tests with a find that works on GNU find too
• e9dc84d ci: release from a single workflow_dispatch button
• d547015 dependencies: bump go.yaml.in/yaml/v3 v3.0.4 -> v3.0.5
• 3ca97d6 README: add a sponsor badge
• 92bd34a README: dark-mode logo and a docs badge
• bc1f21e v1.43.0
• c814c0e v1.43.0 (full)
• Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in stretchr/testify#1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in stretchr/testify#1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in stretchr/testify#1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in stretchr/testify#1665
• assert.PanicsWithError: report error message by @​olivergondza in stretchr/testify#1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in stretchr/testify#1787
• add type to error message of assert.Same by @​egawata in stretchr/testify#1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in stretchr/testify#1795
• assert: truncate very long objects in test failure messages by @​brackendawson in stretchr/testify#1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @​nghiack7 in stretchr/testify#1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in stretchr/testify#1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in stretchr/testify#1708
• Promote ccoVeille to maintainer by @​brackendawson in stretchr/testify#1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in stretchr/testify#1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in stretchr/testify#1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in stretchr/testify#1782
• doc: remove ineffective inline code blocks by @​brackendawson in stretchr/testify#1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in stretchr/testify#1815

... (truncated)

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.56.0 to 0.58.0

Commits

• acc78e0 go.mod: update golang.org/x dependencies
• 90d10f0 internal/http3: delete invalid Content-Length if declared in server handler
• 08abf4d internal/http3: infer headers when Content-Encoding is set but is empty
• 8d10596 http2: avoid deadlocks in wrapped ClientConn state callback
• 99c3b0a http2/hpack: build the table lookup maps lazily, only for encoders
• 5a920b1 http3: rework registration to allow using a fake network
• 7fd2842 quic: return an error from Accept after PacketConn reader exits
• 825111d quic: avoid busy-loop when keep-alive is blocked by congestion control
• a02ddfa http/httpproxy: prioritize lowercase proxy environment variables
• 574e5eb quic: halt conn goroutines on close when listener exits early
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.21.0 to 0.22.0

Commits

• 1eb64d4 semaphore: panic on negative weights
• See full diff in compare view

Updates golang.org/x/text from 0.38.0 to 0.41.0

Commits

• acdba66 go.mod: update golang.org/x dependencies
• 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
• 724af9c go.mod: update golang.org/x dependencies
• bf5b9d6 internal/export/idna: always treat Punycode encoding pure ASCII as an error
• b326f3d go.mod: update golang.org/x dependencies
• 5ae8e57 unicode/norm: avoid infinite loop on invalid input
• 0dc94a2 all: fix some comments
• See full diff in compare view

Updates google.golang.org/grpc from 1.82.1 to 1.84.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.84.0

Behavior Changes

• stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

• xds: Add support for contains_match in route header matchers. (#9223)
  • Special Thanks: @​nvxbug

Bug Fixes

• client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)
  • Special Thanks: @​utkuozdemir
• client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)
  • Special Thanks: @​chengxilo
• credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)
  • Special Thanks: @​buger
• credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)
  • Special Thanks: @​nvxbug
• randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)
  • Special Thanks: @​fallintoplace
• stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)
• transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)
  • Special Thanks: @​buger
• transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)
  • Special Thanks: @​buger
• xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#9140)
• xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#9223)
  • Special Thanks: @​nvxbug
• xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#9223)
  • Special Thanks: @​nvxbug
• xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#9257)
  • Special Thanks: @​nvxbug
• xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#9218)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#9250)
  • Special Thanks: @​nvxbug

Performance Improvements

• transport: Avoid a heap allocation when flushing shared write buffers. (#9233)
  • Special Thanks: @​zaidoon1
• credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)

Release 1.83.2

... (truncated)

Commits

• e84aa5a Change version to 1.84.0 (#9324)
• c5ae88d Cherrypick #9204 and #9321 to v1.84.x (#9407)
• a592f6a Cherrypick #9351 and #9404 to v1.84.x (#9408)
• d5a4111 cherry-pick #9365 to v1.84.x (#9370)
• 89d55e0 cherry-pick #9346 to v1.84.x (#9372)
• 8a9f866 Cherry-pick #9332 to v1.84.x (#9338)
• f8b54e7 Cherry-pick #9331 to v1.84.x (#9334)
• 30ce1d5 xds: support injecting bootstrap and server config into HTTP filter config pa...
• 54c743e extproc : wait for async RPC to complete in test (#9311)
• 538bb2f endpointsharding: decouple locking, and simplify ChildState API (#9290)
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​hashicorp/​go-metrics@​v0.6.0 ⏵ v0.7.0	+2
	golang/​github.com/​onsi/​gomega@​v1.42.1 ⏵ v1.43.1	+1
	golang/​golang.org/​x/​net@​v0.56.0 ⏵ v0.58.0	+1
	golang/​google.golang.org/​grpc@​v1.82.1 ⏵ v1.84.0	+1	+8
	golang/​google.golang.org/​protobuf@​v1.36.11 ⏵ v1.36.12	+1
	golang/​golang.org/​x/​text@​v0.38.0 ⏵ v0.41.0	+1
	golang/​google.golang.org/​genproto/​googleapis/​api@​v0.0.0-20260414002931-afd174a4e478 ⏵ v0.0.0-20260706201446-f0a921348800
	golang/​github.com/​cosmos/​ibc-go/​v11@​v11.1.0 ⏵ v11.2.0
	golang/​github.com/​onsi/​ginkgo/​v2@​v2.32.0 ⏵ v2.33.0	+1
	golang/​github.com/​stretchr/​testify@​v1.11.1 ⏵ v1.12.1	-6
	golang/​golang.org/​x/​sync@​v0.21.0 ⏵ v0.22.0	+1

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 47.08%. Comparing base (e9c85d5) to head (ef8439e).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #1092   +/-   ##
========================================
  Coverage    47.08%   47.08%           
========================================
  Files          200      200           
  Lines        17648    17648           
========================================
  Hits          8310     8310           
  Misses        8476     8476           
  Partials       862      862           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang github.com/googleapis/enterprise-certificate-proxy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → golang/google.golang.org/grpc@v1.84.0 → golang/github.com/grpc-ecosystem/grpc-gateway@v1.16.0 → golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.15 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report