Skip to content

Update go modules - #6850

Merged
rdimitrov merged 1 commit into
mainfrom
renovate/go-modules
Oct 19, 2026
Merged

Update go modules#6850
rdimitrov merged 1 commit into
mainfrom
renovate/go-modules

Conversation

@renovate

@renovate renovate Bot commented Oct 17, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/Microsoft/go-winio v0.6.3 → v0.6.4 age confidence
github.com/go-chi/chi/v5 v5.4.0 → v5.5.0 age confidence
github.com/go-jose/go-jose/v4 v4.1.5 → v4.1.6 age confidence
github.com/sigstore/sigstore v1.11.0 → v1.11.1 age confidence
github.com/stacklok/toolhive-core v0.0.52 → v0.0.55 age confidence
github.com/stacklok/toolhive-core/redisconn v0.0.2 → v0.0.4 age confidence
golang.ngrok.com/ngrok/v2 v2.2.0 → v2.2.1 age confidence
oras.land/oras-go/v2 v2.6.3 → v2.6.4 age confidence

Release Notes

Microsoft/go-winio (github.com/Microsoft/go-winio)

v0.6.4

Compare Source

What's Changed

Full Changelog: microsoft/go-winio@v0.6.3...v0.6.4

go-chi/chi (github.com/go-chi/chi/v5)

v5.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.4.0...v5.5.0

go-jose/go-jose (github.com/go-jose/go-jose/v4)

v4.1.6

Compare Source

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

sigstore/sigstore (github.com/sigstore/sigstore)

v1.11.1

Compare Source

What's Changed

v1.11.1 drops the Go version directive to a minor release, 1.27, rather than the patch release, 1.27.0. Dependents will need to remove the patch version .0 from go.mod files, as go mod tidy will not automatically do so.

  • Support ML-DSA for GCP KMS keys in #​2395
  • Set go directive to minor version only (go 1.27) in #​2436
  • Check private key size in LoadED25519phSigner in #​2438

Full Changelog: sigstore/sigstore@v1.11.0...v1.11.1

stacklok/toolhive-core (github.com/stacklok/toolhive-core)

v0.0.55

Compare Source

What's Changed

New Contributors

Full Changelog: stacklok/toolhive-core@v0.0.54...v0.0.55

v0.0.54

Compare Source

What's Changed

Full Changelog: stacklok/toolhive-core@v0.0.53...v0.0.54

v0.0.53

Compare Source

What's Changed

Full Changelog: stacklok/toolhive-core@v0.0.52...v0.0.53

ngrok/ngrok-go (golang.ngrok.com/ngrok/v2)

v2.2.1

Compare Source

What's Changed

New Contributors

Full Changelog: ngrok/ngrok-go@v2.2.0...v2.2.1

oras-project/oras-go (oras.land/oras-go/v2)

v2.6.4

Compare Source

This is a patch release with security fixes to the file store and auth client, and bug fixes to the file store, OCI store, and retry layers since v2.6.3.

Security Fixes

  • Remove a symlink at the target path before writing in the file store's pushFile and pushDir, and open files with O_NOFOLLOW on unix, so a pushed blob can no longer be written through a planted terminal symlink to a file outside the store root (GHSA-2hhj-vj64-hx3j)
  • Skip restoring times and mode on symlinks during tar extraction, and replace a symlink at a directory entry's path with a real directory, so a crafted unpack layer can no longer change the timestamps or permissions of files outside the store root (GHSA-jh75-xv39-vhvx)
  • Compare each redirect hop against the first request in auth.Client, so a second same-origin hop on the redirect target no longer restores the Authorization header removed by the GHSA-vh4v-2xq2-g5cg guard, and refuse to resend an OAuth2 token request body (password or refresh token) to another origin on a 307 or 308 (GHSA-xc97-9f2f-9hrx)
  • Resolve non-literal bearer realm hosts and reject realms resolving to loopback, link-local, private, unspecified, or carrier-grade NAT addresses, and re-validate every redirect hop of distribution and OAuth2 token requests, so a realm such as localhost or a DNS name pointing at an internal address no longer bypasses validateRealm (GHSA-mm27-wq9c-mxxr)

Bug Fixes

  • Resolve tar hard link targets from the archive root rather than the link's directory, so a hard link whose target sits in another directory extracts instead of failing with "no such file or directory" (#​1510, #​1572)
  • Skip digest-named directories under blobs/<alg>/ during OCI store GC, which previously aborted on a non-empty directory; os.Remove errors now include the blob path (#​1526, #​1579, #​1588)
  • Retry on connection reset by peer and unexpected EOF in retry.DefaultPredicate, so a single reset from a registry no longer fails the whole operation (#​1567, #​1570)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from JAORMX as a code owner October 17, 2026 05:57
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 17, 2026
@renovate

renovate Bot commented Oct 17, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
github.com/ProtonMail/go-crypto v1.4.1 -> v1.5.2
github.com/docker/cli v29.7.2+incompatible -> v29.9.0+incompatible
github.com/klauspost/compress v1.20.1 -> v1.20.3
golang.org/x/exp v0.0.0-20261011100332-faecfb24eb49 -> v0.0.0-20261014143641-f0251eb4aa3e

@github-actions github-actions Bot added the size/XS Extra small PR: < 100 lines changed label Oct 17, 2026
@codecov

codecov Bot commented Oct 17, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.69%. Comparing base (16ffc0b) to head (aa6d291).

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #6850      +/-   ##
==========================================
- Coverage   79.71%   79.69%   -0.02%     
==========================================
  Files         818      818              
  Lines       83583    83583              
==========================================
- Hits        66626    66613      -13     
- Misses      16952    16965      +13     
  Partials        5        5

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@rdimitrov
rdimitrov merged commit cc13cc2 into main Oct 19, 2026
43 checks passed
@rdimitrov
rdimitrov deleted the renovate/go-modules branch October 19, 2026 10:01
@github-actions github-actions Bot mentioned this pull request Oct 19, 2026
Merged
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rdimitrov rdimitrov rdimitrov approved these changes
@JAORMX JAORMX Awaiting requested review from JAORMX JAORMX is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file size/XS Extra small PR: < 100 lines changed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rdimitrov