Skip to content

Bump the go-deps group across 1 directory with 8 updates - #1754

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-6f548977e4
Open

Bump the go-deps group across 1 directory with 8 updates#1754
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-6f548977e4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 8 updates in the / directory:

Package From To
cloud.google.com/go/kms 1.32.0 1.34.0
filippo.io/age 1.3.1 1.3.2
github.com/cyphar/filepath-securejoin 0.6.1 0.7.0
github.com/fluxcd/pkg/runtime 0.112.0 0.113.0
github.com/getsops/sops/v3 3.13.2 3.13.3
github.com/onsi/gomega 1.43.0 1.43.1
golang.org/x/net 0.58.0 0.59.0
golang.org/x/oauth2 0.36.0 0.37.0

Updates cloud.google.com/go/kms from 1.32.0 to 1.34.0

Release notes

Sourced from cloud.google.com/go/kms's releases.

retail: v1.34.0

1.34.0 (2026-09-10)

Features

discoveryengine: v1.34.0

1.34.0 (2026-09-17)

Features

kms: v1.34.0

1.34.0 (2026-09-17)

Features

kms: v1.33.0

1.33.0 (2026-07-23)

Features

retail: v1.33.0

1.33.0 (2026-08-13)

Features

cloudbuild: v1.33.0

1.33.0 (2026-08-20)

Features

... (truncated)

Changelog

Sourced from cloud.google.com/go/kms's changelog.

1.34.0 (2024-09-12)

Features

  • documentai: Add API fields for the descriptions of entity type and property in the document schema (2d5a9f9)

Bug Fixes

  • documentai: Bump dependencies (2ddeb15)

1.33.0 (2024-08-20)

Features

  • documentai: Add support for Go 1.23 iterators (84461c0)
Commits
  • 94d24ca chore: librarian release pull request: 20260507T184113Z (#14549)
  • 541569e docs: update README to reflect Gemini Enterprise Agent Platform
  • 237533a Merge pull request #14545 from googleapis:release-agentplatform-0.20.0
  • d70876a chore: release agentplatform@v0.20.0
  • 32a256f feat(agentplatform): Add structured data and memory type to Memory.
  • 37572e3 chore: update librarian to use new config command (#14540)
  • d6d7382 chore(agentplatform): update deps
  • fd34e97 feat(geminidataanlytics): generate v1 client (#14542)
  • 07fe29b feat: update API sources and regenerate (#14537)
  • 6b9f6c7 feat(memorystore): enable gRPC transport (#14532)
  • Additional commits viewable in compare view

Updates filippo.io/age from 1.3.1 to 1.3.2

Release notes

Sourced from filippo.io/age's releases.

age v1.3.2 is a minor release with a wide range of fixes and hardening improvements.

Some previously-accepted inputs are now rejected: headers over 2 MiB or 1024 recipients, malformed SSH keys in recipients files, and non-UTF-8 plaintext written to a terminal (force with -o -).

Pre-built binaries now cover windows/arm64 and darwin/amd64, and release archives include the compatibility plugins (age-plugin-pq, age-plugin-tag, and age-plugin-tagpq).

Commits
  • b74dce4 doc: regenerate groff and html man pages
  • 5c1b90c all: release v1.3.2
  • 7fcc72e plugin: correct working directory comment
  • 58ef9fc cmd/age-keygen: correct public key output documentation
  • de96c8e cmd/age: reject invalid UTF-8 terminal output
  • 3604609 cmd/age-plugin-batchpass: correct documented scrypt limit
  • 6ff2f30 cmd/age: enable PTY tests on Darwin
  • cdb30a1 cmd/age: recognize armored identity files after whitespace
  • 9cbe8d8 plugin: allow empty prompt responses
  • eb70608 internal/format: validate stanza fields when marshaling
  • Additional commits viewable in compare view

Updates github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.7.0 -- "You talk of times of peace for all, and then prepare for war."

Changed

  • Update to cyphar.com/go-pathrs@0.2.5, which included a build-time API breakage that we needed to work around. The API of this library is unchanged by this, but users should make sure to update to v0.7.0 of filepath-securejoin if they use the libpathrs built tag and have update to libpathrs v0.2.5.

Signed-off-by: Aleksa Sarai cyphar@cyphar.com

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.7.0] - 2025-06-17

You talk of times of peace for all, and then prepare for war.

Changed

  • Update to cyphar.com/go-pathrs@0.2.5, which included a build-time API breakage that we needed to work around. The API of this library is unchanged by this, but users should make sure to update to v0.7.0 of filepath-securejoin if they use the libpathrs built tag and have update to libpathrs v0.2.5.
Commits
  • 8096a95 VERSION: release v0.7.0
  • 1324ccb merge #101 into cyphar/filepath-securejoin:main
  • dd8f0bb deps: bump to cyphar.com/go-pathrs@v0.2.5
  • c9a7725 gha: bump golangci-lint to v2.12
  • 2e968bd Merge pull request #91 from cyphar/dependabot/github_actions/actions/download...
  • 2879148 Merge pull request #90 from cyphar/dependabot/github_actions/actions/upload-a...
  • 07b805b build(deps): bump actions/download-artifact from 6 to 7
  • 8507844 build(deps): bump actions/upload-artifact from 5 to 6
  • daef0cf Merge pull request #89 from cyphar/dependabot/github_actions/actions/checkout-6
  • 95f8ea4 build(deps): bump actions/checkout from 5 to 6
  • Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.112.0 to 0.113.0

Commits
  • fc29ca0 Merge pull request #1293 from fluxcd/release-main
  • 98725a2 Prepare for release
  • 1e50081 Merge pull request #1144 from adri1197/event-api
  • 46f413f Migrate event recorder to events/v1 API
  • 46433b8 Merge pull request #1298 from dipti-pai/kustomize-substitute-with-vars
  • 56fb7e5 kustomize: add ContextWithSecretVarsCollector for LoadVariables
  • 6d8d5d9 Merge pull request #1292 from fluxcd/k8s-1.37.0
  • a532207 auth: Update cloud SDKs
  • bc7fd2f Update to Kubernetes 1.37.0
  • c437e4f Merge pull request #1290 from fluxcd/comment-migrate-api-version
  • Additional commits viewable in compare view

Updates github.com/getsops/sops/v3 from 3.13.2 to 3.13.3

Release notes

Sourced from github.com/getsops/sops/v3's releases.

v3.13.3

Installation

To install sops, download one of the pre-built binaries provided for your platform from the artifacts attached to this release.

For instance, if you are using Linux on an AMD64 architecture:

# Download the binary
curl -LO https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.linux.amd64
Move the binary in to your PATH
mv sops-v3.13.3.linux.amd64 /usr/local/bin/sops
Make the binary executable
chmod +x /usr/local/bin/sops

Verify checksums file signature

The checksums file provided within the artifacts attached to this release is signed using Cosign with GitHub OIDC. To validate the signature of this file, run the following commands:

# Download the checksums file, certificate and signature
curl -LO https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.checksums.txt
curl -LO https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.checksums.sigstore.json
Verify the checksums file
cosign verify-blob sops-v3.13.3.checksums.txt 
--bundle sops-v3.13.3.checksums.sigstore.json 
--certificate-identity-regexp=https://github.com/getsops 
--certificate-oidc-issuer=https://token.actions.githubusercontent.com

Verify binary integrity

To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature:

# Verify the binary using the checksums file
sha256sum -c sops-v3.13.3.checksums.txt --ignore-missing

Verify artifact provenance

The SLSA provenance of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an in-toto link metadata file named sops-v3.13.3.intoto.jsonl. To verify the provenance of an artifact, you can utilize the slsa-verifier tool:

# Download the metadata file
curl -LO  https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.intoto.jsonl
</tr></table>

... (truncated)

Changelog

Sourced from github.com/getsops/sops/v3's changelog.

3.13.3

Improvements:

Bugfixes:

  • Fix a bug introduced in 3.13.2 that computes a wrong MAC during decryption for sequences (YAML lists) that contain a comment (#2245).
  • Fix completion subcommands so that they do not have an empty line before the shebang (#2253).

Project changes:

  • CI dependency updates (#2241, #2250, #2260).
  • Rust dependency updates for functional tests (#2259).
Commits
  • 26e2f47 Merge pull request #2249 from felixfontein/release-3.13.3
  • 357de8a Fix old changelog.
  • 73f38b8 Add changelog.
  • 74428b6 Bump version to 3.13.3.
  • f5fe6ab Merge pull request #2253 from felixfontein/completion
  • 238f71b Remove leading newline.
  • 5a745f3 Merge pull request #2248 from felixfontein/deps
  • f406e83 Update dependencies with 'go get -t -u ./...'.
  • 7149e91 Merge pull request #2259 from getsops/dependabot/cargo/functional-tests/rust-...
  • fefb6ee build(deps): Bump the rust group in /functional-tests with 3 updates
  • Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.43.0 to 1.43.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.43.1

Maintenance

  • Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
  • Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]
Changelog

Sourced from github.com/onsi/gomega's changelog.

1.43.1

Maintenance

  • Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
  • Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]
Commits
  • 1fca5c2 v1.43.1
  • 47f0f87 v1.43.1 (full)
  • be53601 changelog: entries for the yaml bump and the release flow
  • e06b67c fix(ci): strip the tests with a find that works on GNU find too
  • e9dc84d ci: release from a single workflow_dispatch button
  • d547015 dependencies: bump go.yaml.in/yaml/v3 v3.0.4 -> v3.0.5
  • 3ca97d6 README: add a sponsor badge
  • 92bd34a README: dark-mode logo and a docs badge
  • See full diff in compare view

Updates golang.org/x/net from 0.58.0 to 0.59.0

Commits
  • 540d04c go.mod: update golang.org/x dependencies
  • 20eef7f quic: clear fast-path receive buffer on stream reset
  • c23af1b internal/http3: fix compilation error due to missed symbol name update
  • eda109f internal/http3: send appropriate error codes in STOP_SENDING frames
  • 12e0501 internal/http3: server header size limits
  • d89285e quic: add Stream.StopSending, and rework stream/application errors
  • d34deae quic: ensure Endpoint.Close waits for connection loops to exit
  • 55577aa http2: use IDNA Lookup profile, not raw Punycode translation
  • b22627e internal/http3: handle a nil TLSConfig in newQUICConfig
  • 6e98b0d internal/http3: report endpoint creation errors from initEndpoint
  • Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.36.0 to 0.37.0

Commits
  • c624b89 google: change the snake case endpoint to kebab-case
  • 09a82f6 all: upgrade go directive to at least 1.26.0 [generated]
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the go-deps group across 1 directory with 8 updates
dc5293e 
Bumps the go-deps group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) | `1.32.0` | `1.34.0` |
| [filippo.io/age](https://github.com/FiloSottile/age) | `1.3.1` | `1.3.2` |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.6.1` | `0.7.0` |
| [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.112.0` | `0.113.0` |
| [github.com/getsops/sops/v3](https://github.com/getsops/sops) | `3.13.2` | `3.13.3` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.43.0` | `1.43.1` |
| [golang.org/x/net](https://github.com/golang/net) | `0.58.0` | `0.59.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.36.0` | `0.37.0` |



Updates `cloud.google.com/go/kms` from 1.32.0 to 1.34.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](googleapis/google-cloud-go@kms/v1.32.0...dlp/v1.34.0)

Updates `filippo.io/age` from 1.3.1 to 1.3.2
- [Release notes](https://github.com/FiloSottile/age/releases)
- [Commits](FiloSottile/age@v1.3.1...v1.3.2)

Updates `github.com/cyphar/filepath-securejoin` from 0.6.1 to 0.7.0
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.6.1...v0.7.0)

Updates `github.com/fluxcd/pkg/runtime` from 0.112.0 to 0.113.0
- [Commits](fluxcd/pkg@runtime/v0.112.0...runtime/v0.113.0)

Updates `github.com/getsops/sops/v3` from 3.13.2 to 3.13.3
- [Release notes](https://github.com/getsops/sops/releases)
- [Changelog](https://github.com/getsops/sops/blob/main/CHANGELOG.md)
- [Commits](getsops/sops@v3.13.2...v3.13.3)

Updates `github.com/onsi/gomega` from 1.43.0 to 1.43.1
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.43.0...v1.43.1)

Updates `golang.org/x/net` from 0.58.0 to 0.59.0
- [Commits](golang/net@v0.58.0...v0.59.0)

Updates `golang.org/x/oauth2` from 0.36.0 to 0.37.0
- [Commits](golang/oauth2@v0.36.0...v0.37.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/kms
  dependency-version: 1.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: filippo.io/age
  dependency-version: 1.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/fluxcd/pkg/runtime
  dependency-version: 0.113.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/getsops/sops/v3
  dependency-version: 3.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.43.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency label Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants