[dependabot]

Bumps the go-modules group with 2 updates: github.com/containerd/stargz-snapshotter/estargz and google.golang.org/grpc.

Updates github.com/containerd/stargz-snapshotter/estargz from 0.19.0 to 0.19.1

Release notes

Sourced from github.com/containerd/stargz-snapshotter/estargz's releases.

v0.19.1

Notable Changes

• fusemanager: remove direct imports of logrus (#2411), thanks to @​thaJeztah
• github.com/Microsoft/go-winio v0.6.3 (#2412), thanks to @​thaJeztah
• verifier: separate pacakges to reduce import dependencies (#2418)
• analyzer: replace ctr signal helpers with local implementations (#2409), thanks to @​thaJeztah
• verifier: fix hang issues (#2422)
• move analyzer package to cmd module (#2410), thanks to @​thaJeztah

Commits

• 1c15860 Merge pull request #2423 from ktock/prepare-0.19.1
• 77e2ecb Prepare for v0.19.1
• 1aa0295 Merge pull request #2410 from thaJeztah/mv_analyzer
• 18b68d8 move analyzer package to cmd module
• 5aec764 Merge pull request #2422 from ktock/fixdeadlock
• 0bc7e38 verifier: let the CRI calls wait for initialization complete
• 85660a6 verifier: fix deadlock on duplicated diffIDs
• fd52c5e Merge pull request #2408 from containerd/dependabot/go_modules/golang-x-70a7e...
• 010574c Merge pull request #2409 from thaJeztah/reduce_c8d_imports
• e3cccb8 build(deps): bump the golang-x group across 2 directories with 2 updates
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

Commits

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions