Skip to content

Bump the go-modules group with 4 updates - #933

Merged
paketo-bot-reviewer merged 1 commit into
mainfrom
dependabot/go_modules/go-modules-10740da20d
Oct 27, 2026
Merged

Bump the go-modules group with 4 updates#933
paketo-bot-reviewer merged 1 commit into
mainfrom
dependabot/go_modules/go-modules-10740da20d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-modules group with 4 updates: github.com/anchore/syft, github.com/docker/cli, github.com/huandu/xstrings and google.golang.org/api.

Updates github.com/anchore/syft from 1.54.1 to 1.55.0

Release notes

Sourced from github.com/anchore/syft's releases.

v1.55.0

Added Features

  • Add support for scanning IPK packages using the deb-archive-cataloger [PR #5111 @​skyhisi]

Bug Fixes

Additional Changes

Dependencies

49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

  • cloud.google.com/go/auth v0.23.2 → v0.23.3
  • cloud.google.com/go/compute/metadata v0.9.0 → v0.9.1
  • cloud.google.com/go/storage v1.65.1 → v1.68.0
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 → v1.34.0
  • github.com/aws/aws-sdk-go-v2 v1.44.0 → v1.47.1
  • github.com/aws/aws-sdk-go-v2/config v1.32.40 → v1.33.6
  • github.com/aws/aws-sdk-go-v2/credentials v1.19.39 → v1.20.6
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 → v1.20.1
  • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 → v1.5.4
  • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 → v2.8.4
  • github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 → v1.5.4
  • github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 → v1.11.5
  • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 → v1.14.4
  • github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 → v1.20.4
  • github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 → v1.114.0
  • github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 → v1.10.1
  • github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 → v1.38.1
  • github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 → v1.43.1
  • github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 → v1.51.1
  • github.com/github/go-spdx/v2 v2.7.0 → v2.7.1

... (truncated)

Commits
  • f15c334 Pin Gguff lib to prevent dropping packages (#5447)
  • a811932 chore(deps): bump github.com/hashicorp/go-getter from 1.8.9 to 1.8.10 (#5436)
  • 50ea429 chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 (#5433)
  • 83ba830 chore(deps): bump github.com/gookit/color from 1.6.1 to 1.6.2 (#5435)
  • 0f1cd9c chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5432)
  • 758c232 chore(deps): bump github.com/github/go-spdx/v2 from 2.7.0 to 2.7.1 (#5434)
  • 30200f1 fix: upgrade to golang.org/x/net v0.61.0 (#5427)
  • ddc490c chore(deps): update anchore dependencies (#5387)
  • 46bac23 chore(deps): bump golang.org/x/tools from 0.50.0 to 0.51.0 (#5417)
  • 07752f0 chore(deps): bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3 (#5416)
  • Additional commits viewable in compare view

Updates github.com/docker/cli from 29.9.1+incompatible to 29.9.2+incompatible

Commits

Updates github.com/huandu/xstrings from 1.6.2 to 1.6.3

Release notes

Sourced from github.com/huandu/xstrings's releases.

Bug fixes for ExpandTabs, Squeeze, justification and first-rune case mapping

This release fixes invalid UTF-8 handling in ExpandTabs, Squeeze and the justification helpers, and makes FirstRuneToUpper / FirstRuneToLower honor all Unicode case mappings.

Most fixes preserve bytes which were not supposed to be changed. As a result, invalid UTF-8 bytes are no longer rewritten as U+FFFD in these functions; valid UTF-8 output is unchanged.

Bug fixes

ExpandTabs: invalid bytes after the first tab

ExpandTabs copied the input prefix before the first tab, but every later rune was written back with WriteRune. Invalid bytes decode to utf8.RuneError and were rewritten as U+FFFD, so the same byte was preserved before a tab and corrupted after it.

  • ExpandTabs("\t\xffx", 4) returned " \uFFFDx" instead of " \xffx".
  • ExpandTabs("\xff\t\xfe", 4) returned "\xff \uFFFD" instead of "\xff \xfe".

Non-tab bytes are now copied unchanged.

Squeeze: retained bytes and duplicate detection

Two separate issues affected invalid input:

  • After the first squeeze, retained runes were written with WriteRune, rewriting invalid bytes as U+FFFD: Squeeze("aa\xffb", "a") returned "a\uFFFDb" instead of "a\xffb", and even a non-matching pattern such as "z" changed the bytes (#73).
  • Duplicate detection compared decoded runes. Every invalid byte decodes to RuneError, so distinct invalid bytes, and an invalid byte next to a valid U+FFFD, were treated as repeated runes and collapsed: Squeeze("\xff\xfe", "") returned "\xff" and Squeeze("\xff\uFFFD", "") returned "\xff" (#76).

Retained bytes are now copied unchanged, and adjacent runes are compared by their original bytes. Identical bytes still squeeze normally when the rune is eligible for squeezing, while distinct sequences are kept.

LeftJustify, RightJustify, Center: truncated pad strings

When the pad string was cut in the middle of its runes, writePadString decoded each pad rune and wrote it back with WriteRune. Invalid bytes in that partial pad became U+FFFD, although complete pad repetitions were already copied unchanged.

  • LeftJustify("a", 3, "x\xffy") returned "ax\uFFFD" instead of "ax\xff".
  • RightJustify("a", 2, "\xffx") returned "\uFFFDa" instead of "\xffa".
  • Center("a", 4, "x\xffy") returned "xax\uFFFD" instead of "xax\xff".

Partial pad bytes are now copied unchanged (#75).

FirstRuneToUpper / FirstRuneToLower: Unicode case mappings outside Ll/Lu

The functions only changed the first rune when unicode.IsLower / unicode.IsUpper was true. Characters with case mappings outside those categories were skipped, including titlecase digraphs, Roman numerals and circled letters.

  • FirstRuneToUpper("Džuro") returned "Džuro" instead of "DŽuro".
  • FirstRuneToLower("Džuro") returned "Džuro" instead of "džuro".
  • FirstRuneToUpper("ⅳ chapter") returned "ⅳ chapter" instead of "Ⅳ chapter".
  • FirstRuneToUpper("ⓐ label") returned "ⓐ label" instead of "Ⓐ label".

The functions now apply unicode.ToUpper / unicode.ToLower and return the original string when the first rune has no mapping. Suffixes, uncased runes and invalid UTF-8 are handled as before (#72).

Behaviour changes

  • FirstRuneToUpper and FirstRuneToLower now change every rune with a standard Unicode simple case mapping, not only runes in Ll/Lu. This includes titlecase, letterlike and circled characters.
  • ExpandTabs, Squeeze, LeftJustify, RightJustify and Center now preserve invalid UTF-8 bytes instead of rewriting them as U+FFFD in the affected paths. The output is byte-preserving, but remains invalid UTF-8 if the input is invalid. Valid UTF-8 results are unchanged.

... (truncated)

Commits
  • 28aabeb Merge pull request #76 from huandu/fix/squeeze-byte-equality
  • 2584c02 Distinguish invalid bytes when squeezing strings
  • 51092b1 Merge pull request #75 from huandu/fix/justify-preserve-pad-bytes
  • 3ded970 Merge pull request #74 from yuefdev/fix/expandtabs-preserve-bytes-sol
  • 51da7c1 Merge pull request #73 from yuefdev/fix/squeeze-preserve-bytes
  • 2128155 Merge pull request #72 from ac1982/fix/first-rune-unicode-case
  • e9f44f0 Preserve pad bytes when justifying strings
  • 8292f9c Preserve untouched bytes when expanding tabs
  • 95eed7c Preserve untouched bytes when squeezing strings
  • 5225f07 Honor Unicode case mappings for the first rune
  • See full diff in compare view

Updates google.golang.org/api from 0.304.0 to 0.305.0

Release notes

Sourced from google.golang.org/api's releases.

v0.305.0

0.305.0 (2026-10-18)

Features

Changelog

Sourced from google.golang.org/api's changelog.

0.305.0 (2026-10-18)

Features

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the go-modules group with 4 updates
125c1c8 
Bumps the go-modules group with 4 updates: [github.com/anchore/syft](https://github.com/anchore/syft), [github.com/docker/cli](https://github.com/docker/cli), [github.com/huandu/xstrings](https://github.com/huandu/xstrings) and [google.golang.org/api](https://github.com/googleapis/google-api-go-client).


Updates `github.com/anchore/syft` from 1.54.1 to 1.55.0
- [Release notes](https://github.com/anchore/syft/releases)
- [Changelog](https://github.com/anchore/syft/blob/main/RELEASE.md)
- [Commits](anchore/syft@v1.54.1...v1.55.0)

Updates `github.com/docker/cli` from 29.9.1+incompatible to 29.9.2+incompatible
- [Commits](docker/cli@v29.9.1...v29.9.2)

Updates `github.com/huandu/xstrings` from 1.6.2 to 1.6.3
- [Release notes](https://github.com/huandu/xstrings/releases)
- [Commits](huandu/xstrings@v1.6.2...v1.6.3)

Updates `google.golang.org/api` from 0.304.0 to 0.305.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.304.0...v0.305.0)

---
updated-dependencies:
- dependency-name: github.com/anchore/syft
  dependency-version: 1.55.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/docker/cli
  dependency-version: 29.9.2+incompatible
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/huandu/xstrings
  dependency-version: 1.6.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: google.golang.org/api
  dependency-version: 0.305.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 27, 2026 14:05
@dependabot
dependabot Bot requested a review from ZephireNZ October 27, 2026 14:05
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 27, 2026
@dependabot dependabot Bot added the go Pull requests that update go code label Oct 27, 2026
@paketo-bot paketo-bot added the semver:patch A change requiring a patch version bump label Oct 27, 2026
@paketo-bot-reviewer
paketo-bot-reviewer merged commit cfb7c5f into main Oct 27, 2026
15 of 16 checks passed
@paketo-bot-reviewer
paketo-bot-reviewer deleted the dependabot/go_modules/go-modules-10740da20d branch October 27, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@paketo-bot-reviewer paketo-bot-reviewer paketo-bot-reviewer approved these changes
@ZephireNZ ZephireNZ Awaiting requested review from ZephireNZ ZephireNZ is a code owner automatically assigned from paketo-buildpacks/dotnet-core-maintainers

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code semver:patch A change requiring a patch version bump

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@paketo-bot-reviewer @paketo-bot