fix(deps): Update Go by renovate[bot] · Pull Request #576 · openpubkey/opkssh

renovate · 2026-07-16T00:54:08Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v3	`v3.0.12` → `v3.3.0`
github.com/melbahja/goph	`v1.4.0` → `v1.5.2`
github.com/spf13/afero	`v1.14.0` → `v1.15.0`
github.com/spf13/cobra	`v1.9.1` → `v1.10.2`
github.com/stretchr/testify	`v1.11.1` → `v1.12.1`
github.com/testcontainers/testcontainers-go	`v0.43.0` → `v0.44.0`
github.com/thediveo/enumflag/v2	`v2.0.7` → `v2.2.1`
github.com/zitadel/oidc/v3	`v3.41.0` → `v3.51.1`
golang.org/x/crypto	`v0.54.0` → `v0.57.0`
golang.org/x/mod	`v0.37.0` → `v0.41.0`
golang.org/x/sys	`v0.47.0` → `v0.48.0`
golang.org/x/term	`v0.45.0` → `v0.46.0`

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

`v3.3.0`

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #2280
build(deps): bump github/codeql-action from 4 to 4.37.3 by @dependabot[bot] in #2283
build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @dependabot[bot] in #2287
build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @dependabot[bot] in #2290
build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @dependabot[bot] in #2293
build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @dependabot[bot] in #2301
build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in #2299
build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in #2306
build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @dependabot[bot] in #2316
build(deps): bump github.com/lestrrat-go/dsig from 1.3.0 to 1.4.0 by @dependabot[bot] in #2319
build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @dependabot[bot] in #2321
[v3] deprecate AlgorithmsForKey, move to internal by @lestrrat in #2326
[v3] add jws.WithStrictECDSA sign option by @lestrrat in #2328
[v3] fix curve inference claim in docs by @lestrrat in #2330
build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @dependabot[bot] in #2332
add example for bounded WithWaitReady wait by @lestrrat in #2343
show fetch failure cause via error sink by @lestrrat in #2344
[v3] escape JSON object member names on output by @lestrrat in #2349

Full Changelog: lestrrat-go/jwx@v3.2.0...v3.3.0

`v3.2.0`

Compare Source

For more detailed release notes, see Changes.

What's Changed

build(deps): bump github.com/lestrrat-go/dsig from 1.2.1 to 1.3.0 by @dependabot[bot] in #2043
build(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in #2159
build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #2174
build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #2179
build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #2180
build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #2184
bump httprc to v3.0.6 by @lestrrat in #2189
autodoc updates by @github-actions[bot] in #2190
build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #2192
build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2226
build(deps): bump actions/cache from 5.0.5 to 6.0.0 by @dependabot[bot] in #2231
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #2230
build(deps): bump actions/cache from 6.0.0 to 6.1.0 by @dependabot[bot] in #2238
build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot[bot] in #2242
fix misspellings in code comments by @lestrrat in #2249
build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #2254
build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #2250
build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #2258
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #2261
bump x/crypto to v0.54.0 in codegen modules by @lestrrat in #2266
[v3] retain unparseable JWK set keys, opt-in by @lestrrat in #2265
[v3] fix per-call reject-dup-kid override by @lestrrat in #2270
[v3] test jwe rejects UnsupportedKey placeholder by @lestrrat in #2272
[v3] doc: recommend retain mode for third-party JWK sets as PQC rolls out by @lestrrat in #2274
fix jwe JSON AAD serialization by @lestrrat in #2276
add JWE authenticated data option by @lestrrat in #2278

Full Changelog: lestrrat-go/jwx@v3.1.1...v3.2.0

`v3.1.1`

Compare Source

For more detailed release notes, see Changes.

What's Changed

build(deps): bump pozil/auto-assign-issue from 2.2.0 to 2.2.1 by @dependabot[bot] in #2045
guard ecdsa coordinates against oversized big.Int by @lestrrat in #2050
reject jwe with conflicting alg in protected vs per-recipient by @lestrrat in #2052
fix AddressClaim.MarshalJSON for non-printable bytes by @lestrrat in #2056
jwt: only call ParseForm when WithFormKey is supplied by @lestrrat in #2058
jws: jkuProvider rejects fetched keys marked use=enc by @lestrrat in #2060
jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @lestrrat in #2066
build(deps): bump pozil/auto-assign-issue from f245a91 to 7bf9d82 by @dependabot[bot] in #2065
cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @lestrrat in #2071
jws: refuse "b64" header in VerifyCompactFast by @lestrrat in #2081
jws: VerifyCompactFast refusals match jws.VerifyError() class by @lestrrat in #2083
jws: name loose keySet options in fan-out verify error by @lestrrat in #2085
jws: honor RFC 7797 b64=false in Message.MarshalJSON by @lestrrat in #2087
jws: reject literal-JSON "protected" in general-form JWS by @lestrrat in #2089
jwt: ParseRequest: don't skip form body on chunked transfer by @lestrrat in #2091
jwt: pedantic mode enforces cty=JWT nested-envelope shape by @lestrrat in #2094
jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @lestrrat in #2099
jwt: ParseInsecure: parse loop-local payload, not original input by @lestrrat in #2097
jws: Verify rejects b64=false without "b64" listed in "crit" by @lestrrat in #2102
jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @lestrrat in #2104
jws: declare "b64" as typed bool header field by @lestrrat in #2106
jws: reject general-form JWS with top-level "header" sibling of "signatures" by @lestrrat in #2108
jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @lestrrat in #2110
jws: VerifyMessage observes ctx cancellation between loop iterations by @lestrrat in #2112
jws: cleanup follow-ups from recent review (low-severity batch) by @lestrrat in #2114
jwe: DecryptMessage observes ctx cancellation between loop iterations by @lestrrat in #2117
jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @lestrrat in #2119
jwe: WithKey validates alg-vs-key shape at option-time by @lestrrat in #2121
jwe: compression cap error names "decompressed" payload, the option, and the size by @lestrrat in #2123
jwe: bound joined-error count and drop redundant outer Decrypt prefix by @lestrrat in #2125
jwe: keySetProvider surfaces per-key errors via errors.Join by @lestrrat in #2127
jwe: add WithDisabledKeyAlgorithms global policy hook by @lestrrat in #2129
jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @lestrrat in #2131
jwk: stop duplicating JWK fields at JWKS top level on parse by @lestrrat in #2133
jwk: wrap ParseKey errors with ParseError sentinel by @lestrrat in #2135
jwk: stream the keys array with cap-before-allocate by @lestrrat in #2137
jwk: treat nil key from custom KeyParser as continue, not success by @lestrrat in #2140
jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @lestrrat in #2142
Changes: draft v3.1.1 release notes by @lestrrat in #2155

Full Changelog: lestrrat-go/jwx@v3.1.0...v3.1.1

`v3.1.0`

Compare Source

See Changes file for curated list of changes

What's Changed

Appease linter by @lestrrat in #1543
Bump kentaro-m/auto-assign-action from 2.0.0 to 2.0.1 by @dependabot[bot] in #1538
Bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #1542
Bump actions/setup-go from 6.1.0 to 6.2.0 by @dependabot[bot] in #1536
Bump actions/cache from 5.0.1 to 5.0.2 by @dependabot[bot] in #1539
Add AGENTS.md by @lestrrat in #1546
exclude AGENTS.md by @lestrrat in #1548
Bump actions/cache from 5.0.2 to 5.0.3 by @dependabot[bot] in #1545
Bump golang.org/x/crypto from 0.46.0 to 0.47.0 by @dependabot[bot] in #1535
Add symlink by @lestrrat in #1549
Fix jwk.Cache worker issues by @lestrrat in #1552
Exclude CLAUDE.md from autodoc by @lestrrat in #1555
Bump github.com/valyala/fastjson from 1.6.7 to 1.6.9 by @dependabot[bot] in #1561
Bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in #1559
Bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @dependabot[bot] in #1557
Reduce allocations in concatkdf Read by @lestrrat in #1562
Eliminate redundant lock acquisitions in LookupKeyID by @lestrrat in #1563
Replace make+copy with bytes.Clone by @lestrrat in #1564
Use base64.Encode instead of EncodeToString in JWS marshal by @lestrrat in #1565
Cache keyalg/ctalg String() in JWE encrypt/decrypt by @lestrrat in #1566
Inline ndata() in concatkdf New by @lestrrat in #1567
Fix dependabot workflow by @lestrrat in #1574
Bump github.com/valyala/fastjson from 1.6.9 to 1.6.10 by @dependabot[bot] in #1568
Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.4.0 to 4.4.1 by @dependabot[bot] in #1570
Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 in /examples by @dependabot[bot] in #1571
Bump actions/setup-go from 6.2.0 to 6.3.0 by @dependabot[bot] in #1573
harden dependabot workflow by @lestrrat in #1575
fix inverted rlocker condition in RSA key export by @lestrrat in #1576
Fix jwe decrypt typo by @lestrrat in #1577
Fix example naming by @lestrrat in #1578
Chore remove unused blank assigns by @lestrrat in #1579
add WhitelistError sentinel, use errors.Is in test by @lestrrat in #1581
standardize error helpers in jws and jwe by @lestrrat in #1582
add fuzz testing infrastructure for jwt/jws/jwe/jwk by @lestrrat in #1583
fix flaky cache and jwt validation tests by @lestrrat in #1585
add .claude/docs and pre-read rules to AGENTS.md by @lestrrat in #1584
Bump golang.org/x/crypto from 0.48.0 to 0.49.0 by @dependabot[bot] in #1587
Bump github.com/emmansun/gmsm from 0.21.5 to 0.41.1 in /examples by @dependabot[bot] in #1590
Bump actions/cache from 5.0.3 to 5.0.4 by @dependabot[bot] in #1593
Bump github.com/goccy/go-json from 0.10.3 to 0.10.6 by @dependabot[bot] in #1589
Bump kentaro-m/auto-assign-action from 2.0.1 to 2.0.2 by @dependabot[bot] in #1595
use standard go deprecation markers in jws by @lestrrat in #1596
fix probe field name in panic message by @lestrrat in #1597
Bump github.com/lestrrat-go/httprc/v3 from 3.0.4 to 3.0.5 by @dependabot[bot] in #1599
Bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #1600
enforce crit header validation in jws.Verify per RFC 7515 by @lestrrat in #1601
validate crit header in VerifyCompactFast by @lestrrat in #1602
fix X25519 ECDH-ES to include apu/apv in KDF by @lestrrat in #1603
enforce minimum PBES2 iteration count by @lestrrat in #1604
reject null JSON values for string claims (#1484) by @lestrrat in #1605
add RFC 9864 fully-specified EdDSA signature algorithms by @lestrrat in #1606
add extension APIs and KeyKind dispatch for external algorithm modules by @lestrrat in #1607
add jwkunsafe package docs and tests by @lestrrat in #1609
delegate custom algorithm registration to dsig by @lestrrat in #1610
autodoc updates by @github-actions[bot] in #1611
pin ed448 module to latest jwx by @lestrrat in #1612
move ed448 to external jwx-circl-ed448 repo by @lestrrat in #1613
autodoc updates by @github-actions[bot] in #1614
pin jwx-circl-ed448 to latest commit by @lestrrat in #1615
update Changes for v3.0.14 by @lestrrat in #1616
use jwk.Import fallback in AlgorithmsForKey by @lestrrat in #1617
fix OKP key export dispatch for Ed448 by @lestrrat in #1618
fix misleading Ed448 dispatch comments in jwsbb by @lestrrat in #1619
add RegisterAlgorithmForCurve, filter AlgorithmsForKey by curve by @lestrrat in #1620
pin jwx-circl-ed448 to ce28e4b in examples by @lestrrat in #1621
add WithMaxFetchBodySize to limit Fetch response body by @lestrrat in #1622
add per-call PBES2 count overrides to jwe.Decrypt by @lestrrat in #1623
fix X509CertChain() to return false when chain is nil by @lestrrat in #1624
fix data race in x509 decoder registry iteration by @lestrrat in #1625
add max key count limit to PEM parsing loop by @lestrrat in #1626
reject negative WithAcceptableSkew in jwt.Validate by @lestrrat in #1627
accept year 0000 in OIDC birthdate per spec by @lestrrat in #1628
update Changes for #1620-#1628 by @lestrrat in #1629
add max input size limit to jwt/jwe ParseReader by @lestrrat in #1630
add global default for MaxFetchBodySize by @lestrrat in #1631
fix parse size limit race, validation, and jws coverage by @lestrrat in #1632
add max recipients limit for JWE messages by @lestrrat in #1633
add default HTTP timeout for jwk.Fetch by @lestrrat in #1634
document jti replay protection as caller responsibility by @lestrrat in #1635
add max signatures limit for JWS messages by @lestrrat in #1636
add default redirect policy for jwk.Fetch by @lestrrat in #1637
add jwk.DefaultHTTPClient by @lestrrat in #1638
check redirect scheme downgrade at every hop by @lestrrat in #1639
apply default redirect policy to jwk.Cache by @lestrrat in #1640
make null string claim rejection opt-in by @lestrrat in #1641
add jwk.WrapHTTPClientDefaults by @lestrrat in #1642
update Changes for #1630-#1640 by @lestrrat in #1643
document WithHTTPClient bypass of defaults by @lestrrat in #1646
use atomic wrappers for global settings by @lestrrat in #1647
reuse shared HTTP client in Cache.Register by @lestrrat in #1648
accept ParseOption in jws.ParseString by @lestrrat in #1650
validate maxSignatures is positive by @lestrrat in #1649
document body size limit approach in jwk.Fetch by @lestrrat in #1651
remove minor entries from Changes by @lestrrat in #1653
make WithStrictStringClaims per-call only by @lestrrat in #1654
add per-call opt-out for crit header validation by @lestrrat in #1655
protect global settings with mutex by @lestrrat in #1656
document WithStrictStringClaims scope to JWT only by @lestrrat in #1657
document WithStrictStringClaims scope includes JWK by @lestrrat in #1658
deep-copy slice fields in generated Set methods by @lestrrat in #1659
zero private key fields on UnmarshalJSON error by @lestrrat in #1660
document x509 validation as out of scope by @lestrrat in #1661
update Changes for #1659 and #1660 by @lestrrat in #1662
fix inconsistent mutex locking in data structures by @lestrrat in #1666
replace intermediate map in MarshalJSON with pair+pool by @lestrrat in #1667
validate algorithm-key compatibility in WithKey by @lestrrat in #1668
reduce allocations in JWE encrypt path by @lestrrat in #1676
Bump golang.org/x/crypto from 0.49.0 to 0.50.0 by @dependabot[bot] in #1684
clean up jws sign/verify code for legibility by @lestrrat in #1687
clean up jws sign/verify key selection code by @lestrrat in #1689
fix dependabot workflow for develop/v2 bazel by @lestrrat in #1691
use squash merge in dependabot workflow by @lestrrat in #1692
remove auto-approve and auto-merge from dependabot workflow by @lestrrat in #1693
scrub full backing array in byte slice pool by @lestrrat in #1729
clear fieldPair list before returning to pool by @lestrrat in #1732
rework jws crit header validation by @lestrrat in #1733
add jwe crit header validation by @lestrrat in #1735
clone per-recipient headers, recycle via headerPool by @lestrrat in #1739
reject ecdh keys in AlgorithmsForKey by @lestrrat in #1741
stop pooling escaping big.Int in buildRSAPublicKey by @lestrrat in #1745
auto-declare b64 crit when WithDetachedPayload is set by @lestrrat in #1748
fail loudly on rand.Reader errors in key gen helpers by @lestrrat in #1751
drop big.Int pool by @lestrrat in #1754
fix race in jwk/ecdsa lookup functions by @lestrrat in #1756
clone protected headers in signatureBuilder.Build by @lestrrat in #1759
fix ValidationCtx extractors panicking on uninitialized contexts by @lestrrat in #1761
docs: note ES256K low-S non-enforcement by @lestrrat in #1763
reject empty ciphertext/iv/tag in jwe.Message.UnmarshalJSON by @lestrrat in #1768
drop unprotected header merge from jwe.Decrypt by @lestrrat in #1770
document VerifyCompactFast b64:true assumption by @lestrrat in #1773
pin unprotected header merge fix with regression test by @lestrrat in #1776
validate AES-CBC IV length in aescbc.Hmac.Open by @lestrrat in #1778
reslice pooled jwe buffers before defer by @lestrrat in #1781
reject sub-minimum input in RFC 3394 keywrap primitives by @lestrrat in #1784
add jwe.WithPBES2Count encrypt option by @lestrrat in #1782
jwe: use privkey.Size() for RSA PKCS1v1.5 length check by @lestrrat in #1788
document default InsecureWhitelist on jwk.Fetch (JWK-001) by @lestrrat in #1790
reject crit-bearing messages in jws.VerifyCompactFast by @lestrrat in #1793
jwe: stop aliasing AAD backing slices when concatenating external aad by @lestrrat in #1796
validate ECDSA point on curve (JWK-003) by @lestrrat in #1797
copy recipientKey in KeyDecryptAESGCMKW to avoid caller aliasing (JWE-002) by @lestrrat in #1800
strip key options in jwt.ParseInsecure by @lestrrat in #1802
Bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #1795
enforce jws signatures cap before decoding entries by @lestrrat in #1804
cap SplitCompactReader non-finite reads at 10 MiB by @lestrrat in #1806
copy rawKey in symmetricKey.Import to avoid caller aliasing by @lestrrat in #1808
enforce max parse input size in jws.Parse and jwe.Parse by @lestrrat in #1809
fix cert.Chain.Add to strip real PEM markers by @lestrrat in #1814
fix jwk x509 decoder unregister index and race by @lestrrat in #1812
fix jwt fast path json injection via unescaped kid by @lestrrat in #1817
fix nil-aware ok return in jws header accessors by @lestrrat in #1818
fix: jwk.PublicSetOf rejects symmetric keys by default (v3.1.0) by @lestrrat in #1829
autodoc updates by @github-actions[bot] in #1832
fix jwk rsa exponent truncation and thumbprint collision by @lestrrat in #1833
fix cert.Chain MarshalJSON and validate Add input by @lestrrat in #1836
fix jwt fast path json injection via unescaped alg by @lestrrat in #1838
track aes-cbc-hmac tag length independently of key size by @lestrrat in #1841
fix jwe aescbc open opaque errors by @lestrrat in #1843
fix jwe keyset selecting keys without alg field by @lestrrat in #1845
fix jwe ecdh-es invalid-curve attack surface by @lestrrat in #1847
fix jwk.Set.AddKey panic on nil or struct keys by @lestrrat in #1852
fix jwk parser to validate keys after unmarshal by @lestrrat in #1854
wrap underlying error in jwk set single-key fallback by @lestrrat in #1856
fix cmd/jwx output file mode and truncation by @lestrrat in #1858
fix jwt.ParseHeader bearer scheme per rfc 6750 by @lestrrat in #1859
make MissingRequiredClaimError.Is type-only by @lestrrat in #1862
document WithUseNumber concurrency contract as startup-only by @lestrrat in #1864
reject key-bearing options in jwt.ParseInsecure by @lestrrat in #1867
bound jws keyset verification fan-out by header alg by @lestrrat in #1869
add jwk.WithForceAssign to overwrite existing kid by @lestrrat in #1874
tighten HeaderGetStringBytes lifetime doc by @lestrrat in #1876
fix jwxio limited reader detection by @lestrrat in #1877
fix jwa error truncation by @lestrrat in #1880
fix jwa registry snapshots by @lestrrat in #1883
tighten jws validateAlgorithmForKey escape by @lestrrat in #1887
fix jws jku kid-miss silent nil by @lestrrat in #1888
surface jku kid-miss error from jkuProvider by @lestrrat in #1891
fix jws VerifyCompactFast header alg cross-check by @lestrrat in #1893
fix okp key length checks by @lestrrat in #1896
fix jwa builtin protection by @lestrrat in #1899
fix v3 rsa jwk validation by @lestrrat in #1895
fix compact sign errors by @lestrrat in #1902
zero bytes.Buffer backing array on pool return by @lestrrat in #1905
remove internal/json.Dump debug helper by @lestrrat in #1907
fix SplitCompactReader LimitedReader size bypass by @lestrrat in #1909
fix jwe godoc references by @lestrrat in #1911
fix v3 jwt package docs by @lestrrat in #1915
fix v3 jwe cek length checks by [@lestrr

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-17T11:38:21Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

28 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.0` -> `1.26.0`
`github.com/bmatcuk/doublestar/v4`	`v4.9.0` -> `v4.10.0`
`github.com/docker/go-connections`	`v0.6.0` -> `v0.7.0`
`github.com/ebitengine/purego`	`v0.10.0` -> `v0.10.1`
`github.com/felixge/httpsnoop`	`v1.0.4` -> `v1.1.0`
`github.com/go-chi/chi/v5`	`v5.2.4` -> `v5.3.2`
`github.com/go-logr/logr`	`v1.4.3` -> `v1.4.4`
`github.com/go-ole/go-ole`	`v1.2.6` -> `v1.3.0`
`github.com/lestrrat-go/dsig`	`v1.0.0` -> `v1.4.0`
`github.com/lestrrat-go/httprc/v3`	`v3.0.1` -> `v3.0.6`
`github.com/lufia/plan9stats`	`v0.0.0-20211012122336-39d0f177ccd0` -> `v0.0.0-20260330125221-c963978e514e`
`github.com/moby/moby/api`	`v1.54.2` -> `v1.55.0`
`github.com/moby/moby/client`	`v0.4.0` -> `v0.5.0`
`github.com/pkg/sftp`	`v1.13.7` -> `v1.13.11`
`github.com/shirou/gopsutil/v4`	`v4.26.5` -> `v4.26.6`
`github.com/spf13/pflag`	`v1.0.6` -> `v1.0.9`
`github.com/tklauser/go-sysconf`	`v0.3.16` -> `v0.4.0`
`github.com/tklauser/numcpus`	`v0.11.0` -> `v0.12.0`
`github.com/valyala/fastjson`	`v1.6.4` -> `v1.6.10`
`github.com/zitadel/schema`	`v1.3.1` -> `v1.3.2`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.60.0` -> `v0.69.0`
`go.opentelemetry.io/otel`	`v1.41.0` -> `v1.45.0`
`go.opentelemetry.io/otel/metric`	`v1.41.0` -> `v1.45.0`
`go.opentelemetry.io/otel/trace`	`v1.41.0` -> `v1.45.0`
`golang.org/x/net`	`v0.56.0` -> `v0.58.0`
`github.com/decred/dcrd/dcrec/secp256k1/v4`	`v4.4.0` -> `v4.4.1`
`github.com/goccy/go-json`	`v0.10.5` -> `v0.10.6`
`golang.org/x/oauth2`	`v0.30.0` -> `v0.36.0`
`golang.org/x/text`	`v0.40.0` -> `v0.42.0`

renovate Bot added the dependencies Pull requests that update a dependency file label Jul 16, 2026

renovate Bot force-pushed the renovate/go branch from 66db879 to 8013c89 Compare July 17, 2026 11:38

renovate Bot force-pushed the renovate/go branch 7 times, most recently from 3cc3a1e to 39dbe62 Compare July 27, 2026 18:37

renovate Bot force-pushed the renovate/go branch 8 times, most recently from 46b16ea to f3ad008 Compare August 6, 2026 05:00

renovate Bot force-pushed the renovate/go branch 6 times, most recently from 16a91bf to 9fc6f92 Compare August 14, 2026 06:43

renovate Bot force-pushed the renovate/go branch 5 times, most recently from 63843c4 to 1f532d0 Compare August 19, 2026 21:39

renovate Bot force-pushed the renovate/go branch from 1f532d0 to a2504f1 Compare August 21, 2026 20:34

renovate Bot force-pushed the renovate/go branch 20 times, most recently from 8628d5a to f5626d4 Compare September 3, 2026 06:05

renovate Bot force-pushed the renovate/go branch 7 times, most recently from 21b10ae to 903bda7 Compare September 9, 2026 10:39

renovate Bot force-pushed the renovate/go branch from 903bda7 to 859e524 Compare September 14, 2026 10:51

fix(deps): Update Go

a1ac6d3

renovate Bot force-pushed the renovate/go branch from 859e524 to a1ac6d3 Compare September 16, 2026 16:42

Navigation Menu

fix(deps): Update Go - #576

fix(deps): Update Go#576
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go

renovate Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.3.0

What's Changed

v3.2.0

What's Changed

v3.1.1

What's Changed

v3.1.0

What's Changed

Configuration

Uh oh!

renovate Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 16, 2026 •

edited

Loading

`v3.3.0`

`v3.2.0`

`v3.1.1`

`v3.1.0`

renovate Bot commented Jul 17, 2026 •

edited

Loading