Skip to content

chore(deps): bump the go-dependencies group across 1 directory with 6 updates - #202

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-1ffc45991a
Open

chore(deps): bump the go-dependencies group across 1 directory with 6 updates#202
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-1ffc45991a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 6 updates in the / directory:

Package From To
github.com/NimbleMarkets/ntcharts 0.5.1 0.5.2
github.com/oapi-codegen/oapi-codegen/v2 2.8.0 2.8.1
github.com/oapi-codegen/runtime 1.7.0 1.8.0
golang.org/x/sys 0.48.0 0.49.0
golang.org/x/term 0.46.0 0.47.0
google.golang.org/api 0.300.0 0.308.0

Updates github.com/NimbleMarkets/ntcharts from 0.5.1 to 0.5.2

Changelog

Sourced from github.com/NimbleMarkets/ntcharts's changelog.

v0.5.2 (2026-10-06)

Fixes backported from the v2 branch:

  • Fix Y scaling in wavelinechart and timeserieslinechart so values line up with the Y-axis ticks when the X axis is hidden, as streamlinechart was fixed in v0.5.0 (#7)
  • Never label an axis value as -0 with DefaultLabelFormatter (#7)
  • Fix missing or misplaced final axis labels when the label step doesn't divide the axis evenly (#16)
  • Label the final X-axis tick with the true axis maximum
  • Float64PointScaleBuffer.Offset now returns the offset instead of the scale
Commits
  • 43ba1c9 chore(license): update copyright years to 2024-2026
  • a1c9bd3 Release v0.5.2
  • d605ec0 docs(changelog): add v0.5.2 (unreleased) backported fixes
  • abddec4 fix(linechart): never label an axis value as "-0" (#7)
  • 0fa5c00 fix(buffer): return the point buffer offset
  • a1ba717 fix(linechart): correct final X-axis labels
  • 4637d88 fix: linechart label glitch (#16)
  • e3868df fix: propagate streamlinechart height fix to wave/timeserieslinechart (#7)
  • See full diff in compare view

Updates github.com/oapi-codegen/oapi-codegen/v2 from 2.8.0 to 2.8.1

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

v2.8.1: Security fixes for codegen and at runtime

🎉 Notable changes

This is a security release on top of v2.8.0. It addresses five security findings reported against oapi-codegen:

Four of the five only matter when you generate code from a specification you do not control. The first one affects running servers, so please upgrade the generated code and the oapi-codegen/runtime and validation middleware modules together, as described below.

Allow-listing the remote documents a specification may reference

oapi-codegen resolves external $refs while it loads a specification. Until now it fetched any http(s) URL a document named, so a specification written by someone else could make the generator reach any host the build machine can see.

There is a new top-level configuration option, allow-remote-refs-from. Each entry is the URL of a referenced document exactly as it appears in the $ref, without the #... fragment, or "*" to allow any URL:

allow-remote-refs-from:
  - https://raw.githubusercontent.com/example/specs/main/common.yaml

For compatibility, this release defaults the option to "*" when it is omitted, so existing configurations keep working unchanged. The next minor release will default to refusing remote references. If your specification downloads other documents at generation time, tighten this now by listing them, or set the option to [] to refuse them all.

Better still, for reproducible builds, download the specifications you depend on, commit them next to your own, and reference them by relative path. References to local files are always followed, with no allow-listing involved, and your generated code no longer depends on a remote host being up and unchanged.

Strict servers bind the value the validation middleware validated

A validation middleware decodes the JSON request body to validate it, and the generated strict server then decoded it a second time. encoding/json matches member names case-insensitively, so a body such as

{"role": "user", "ROLE": "admin"}

validates as role: user but was bound as Role: "admin", bypassing the schema's constraints.

Strict servers for every supported framework now bind the value the middleware already validated, with exact member-name matching, and only fall back to decoding the body themselves when no validated value is present. For the fix to take effect you need all three of:

  • code generated with this release;
  • github.com/oapi-codegen/runtime v1.8.0 or later;
  • a validation middleware that keeps the validated value, which the following versions do by default:
    • github.com/oapi-codegen/nethttp-middleware v1.3.1
    • github.com/oapi-codegen/echo-middleware v1.2.1
    • github.com/oapi-codegen/echo-v5-middleware v0.2.1
    • github.com/oapi-codegen/gin-middleware v1.2.1
    • github.com/oapi-codegen/iris-middleware v1.2.1
    • github.com/oapi-codegen/fiber-middleware v1.3.0
    • github.com/oapi-codegen/fiber-v3-middleware v0.3.0

... (truncated)

Commits
  • 068f1bc Quote or validate every spec string that reaches generated Go source (2.8.x b...
  • cedb781 Apply the "*" default to the loader used after an overlay (#2624)
  • b4ddde8 Refuse remote $refs unless their host is in allow-remote-refs-from (2.8.x bac...
  • 7e9bbce Bind the validated request body value in all strict servers (2.8.x backport) ...
  • See full diff in compare view

Updates github.com/oapi-codegen/runtime from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

v1.8.0: Bind the request body value the validator saw

This release adds a request body binder that reuses the value a kin-openapi validation middleware already decoded, so strict servers no longer decode the body a second time with different matching rules. It also rounds out types.Date's text encoding and fixes a deepObject serialization quirk. Existing binding and serialization behaviour is unchanged unless generated code calls the new function. The root module's dependencies are unchanged; the separate strictmiddleware/echo-v5 module now requires Echo v5.4.2.

Notable Changes

BindJSONBody: bind exactly what the validator validated

Strict servers generated by oapi-codegen decode the JSON request body with encoding/json after a validation middleware has already decoded and validated it. The two decoders do not agree on member names: encoding/json matches struct fields case-insensitively, so a body like {"role":"user","ROLE":"admin"} validates as role: user and then binds as Role: "admin". Anything the validator checked can be bypassed by a differently-cased duplicate.

BindJSONBody(r *http.Request, v any) error closes that gap. When the request has passed through a validator built on kin-openapi v0.151.0 or later with openapi3filter.Options.KeepValidatedValue set, the body carries the value the validator decoded, and BindJSONBody binds that value into the destination with BindJSONValue(value, v any) error instead of reading the body again. Binding follows encoding/json's rules (struct tags, embedded structs, json.Unmarshaler and encoding.TextUnmarshaler, base64 for []byte, float64 for any, json.Number preserved) with one deliberate difference: member names are matched to struct fields exactly.

Without a validated value, or when the value cannot be bound into the destination type, BindJSONBody falls back to json.NewDecoder(r.Body).Decode(v), so error responses are unchanged for everyone who is not running a validator. The oapi-codegen validation middlewares enable KeepValidatedValue by default as of nethttp-middleware v1.3.1, echo-middleware v1.2.1, echo-v5-middleware v0.2.1, gin-middleware v1.2.1 and iris-middleware v1.2.1. The net/http strict server template that calls BindJSONBody is landing in oapi-codegenoapi-codegen/oapi-codegen#2605

types.Date implements encoding.TextMarshaler

Date had an UnmarshalText that parses 2006-01-02 but no MarshalText, so it inherited time.Time's RFC 3339 one. Any codec that pairs TextMarshaler with TextUnmarshaler (encoding/xml, DynamoDB mappers, and others) therefore wrote a Date it could not read back. MarshalText now formats with DateFormat, matching MarshalJSON, String and UnmarshalText. Thanks to @​jusabe-kreditz.

deepObject no longer emits param[]=null for nil maps and slices

Marshalling a deepObject parameter whose field held a typed nil map or nil slice produced a param[]=null pair, because the intermediate json.Marshal turned the nil into null. Such fields are now omitted, as an empty map or slice already was. Nil pointers are still serialized as null, as before. Thanks to @​SKalt (#160).

🚀 New features and improvements

🐛 Bug fixes

📦 Dependency updates

Sponsors

We would like to thank our sponsors for their support during this release.

... (truncated)

Commits
  • c0b2ca2 fix(deps): update module github.com/labstack/echo/v5 to v5.4.2 (#166)
  • 170896a Add BindJSONBody to bind the request body value kin-openapi validated (#165)
  • c702e06 fix: omit nil maps and slices from deepObject marshalling (#161)
  • ea5fc39 Add MarshalText to types.Date (#162)
  • 64f16fb chore(deps): update release-drafter/release-drafter action to v7.10.0 (#164)
  • 9808d04 fix(deps): update module github.com/labstack/echo/v5 to v5.4.1 (#163)
  • df8dfa8 chore(deps): update github/codeql-action action to v4.39.1 (#159)
  • ae0fff0 chore(deps): update oapi-codegen/actions action to v0.9.2 (#158)
  • 2fd3480 chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#157)
  • See full diff in compare view

Updates golang.org/x/sys from 0.48.0 to 0.49.0

Commits
  • b6b8557 unix/linux: unify ppc64x syscall wrappers
  • aab6988 unix: add PrctlArg5Ptr
  • cdfd984 unix: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on darwin
  • 782b836 unix/linux: don't warn about closed stderr from child process
  • 61592fb unix: return syscall error in *listxattrNS on BSD
  • c136fda unix/linux/Dockerfile: update to Go 1.26.8
  • f1d0d79 unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls
  • 67f850b unix: update linux to v7.2
  • eb1f659 unix: add O_EXEC and O_SEARCH on darwin
  • 51bc731 unix: add Mmsghdr for linux
  • Additional commits viewable in compare view

Updates golang.org/x/term from 0.46.0 to 0.47.0

Commits

Updates google.golang.org/api from 0.300.0 to 0.308.0

Release notes

Sourced from google.golang.org/api's releases.

v0.308.0

0.308.0 (2026-10-22)

Features

v0.307.0

0.307.0 (2026-10-21)

Features

v0.306.0

0.306.0 (2026-10-20)

Features

Bug Fixes

  • gensupport: Defer chunk context cancellation until response body is closed (#3782) (ef4e011)

v0.305.0

0.305.0 (2026-10-18)

Features

v0.304.0

0.304.0 (2026-10-14)

Features

  • all: Auto-regenerate discovery clients (#3770) (a3ea7ac)
  • all: Auto-regenerate discovery clients (#3773) (795f958)
  • Enable non-blocking mode for generation pipeline (#3772) (bd231b0)

... (truncated)

Changelog

Sourced from google.golang.org/api's changelog.

0.308.0 (2026-10-22)

Features

0.307.0 (2026-10-21)

Features

0.306.0 (2026-10-20)

Features

Bug Fixes

  • gensupport: Defer chunk context cancellation until response body is closed (#3782) (ef4e011)

0.305.0 (2026-10-18)

Features

0.304.0 (2026-10-14)

Features

  • all: Auto-regenerate discovery clients (#3770) (a3ea7ac)
  • all: Auto-regenerate discovery clients (#3773) (795f958)
  • Enable non-blocking mode for generation pipeline (#3772) (bd231b0)

0.303.0 (2026-10-13)

Features

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note

Medium Risk
Dependency-only, but includes oapi-codegen security releases and Google API/auth transitive updates that touch OAuth and generated HTTP client paths; behavior changes are mostly indirect until API code is regenerated.

Overview
This PR only updates go.mod and go.sum—no application source changes.

It bumps six direct dependencies and refreshes their transitive pins (e.g. cloud.google.com/go/auth, golang.org/x/crypto/net/text, Google gRPC/genproto). Notable direct upgrades:

github.com/NimbleMarkets/ntcharts (0.5.1 → 0.5.2) — used by the TUI chart view (internal/tui/chartview.go). Brings line-chart axis/label fixes (Y scaling, “-0” labels, final tick labels).

oapi-codegen/v2 (2.8.0 → 2.8.1) and oapi-codegen/runtime (1.7.0 → 1.8.0) — affects OpenAPI codegen (Makefile / oapi-codegen.yaml) and the generated API types that import runtime. The new versions are a security-focused pair (codegen hardening, strict-server body binding). Regenerating API code with the updated generator is what fully applies those fixes; existing generated files may still reflect an older generator version until the next codegen run.

golang.org/x/sys / x/term — minor bumps supporting terminal/TUI behavior via the Charm stack.

google.golang.org/api (0.300.0 → 0.308.0) — updates discovery clients and related auth helpers used for Google Play and Cloud Resource Manager calls in internal/google.

Reviewed by Cursor Bugbot for commit becf2c3. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
chore(deps): bump the go-dependencies group across 1 directory with 6…
becf2c3 
… updates

Bumps the go-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/NimbleMarkets/ntcharts](https://github.com/NimbleMarkets/ntcharts) | `0.5.1` | `0.5.2` |
| [github.com/oapi-codegen/oapi-codegen/v2](https://github.com/oapi-codegen/oapi-codegen) | `2.8.0` | `2.8.1` |
| [github.com/oapi-codegen/runtime](https://github.com/oapi-codegen/runtime) | `1.7.0` | `1.8.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.48.0` | `0.49.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.300.0` | `0.308.0` |



Updates `github.com/NimbleMarkets/ntcharts` from 0.5.1 to 0.5.2
- [Changelog](https://github.com/NimbleMarkets/ntcharts/blob/v0.5.2/CHANGELOG.md)
- [Commits](NimbleMarkets/ntcharts@v0.5.1...v0.5.2)

Updates `github.com/oapi-codegen/oapi-codegen/v2` from 2.8.0 to 2.8.1
- [Release notes](https://github.com/oapi-codegen/oapi-codegen/releases)
- [Commits](oapi-codegen/oapi-codegen@v2.8.0...v2.8.1)

Updates `github.com/oapi-codegen/runtime` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/oapi-codegen/runtime/releases)
- [Commits](oapi-codegen/runtime@v1.7.0...v1.8.0)

Updates `golang.org/x/sys` from 0.48.0 to 0.49.0
- [Commits](golang/sys@v0.48.0...v0.49.0)

Updates `golang.org/x/term` from 0.46.0 to 0.47.0
- [Commits](golang/term@v0.46.0...v0.47.0)

Updates `google.golang.org/api` from 0.300.0 to 0.308.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.300.0...v0.308.0)

---
updated-dependencies:
- dependency-name: github.com/NimbleMarkets/ntcharts
  dependency-version: 0.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/oapi-codegen/oapi-codegen/v2
  dependency-version: 2.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/oapi-codegen/runtime
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/api
  dependency-version: 0.308.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants