Skip to content

chore(deps): bump the go-dependencies group across 1 directory with 13 updates - #1154

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-60d4d05e7b
Open

chore(deps): bump the go-dependencies group across 1 directory with 13 updates#1154
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-60d4d05e7b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 11 updates in the / directory:

Package From To
github.com/aws/aws-sdk-go-v2 1.45.1 1.46.0
github.com/aws/aws-sdk-go-v2/config 1.33.1 1.33.3
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager 0.4.1 0.4.3
github.com/aws/aws-sdk-go-v2/service/ecs 1.93.0 1.96.0
github.com/aws/aws-sdk-go-v2/service/lambda 1.104.1 1.107.0
github.com/go-playground/validator/v10 10.30.3 10.30.4
github.com/moby/moby/api 1.55.0 1.56.0
github.com/moby/moby/client 0.5.1 0.6.0
github.com/open-policy-agent/opa 1.20.1 1.20.2
golang.org/x/oauth2 0.36.0 0.37.0
google.golang.org/api 0.295.0 0.297.0

Updates github.com/aws/aws-sdk-go-v2 from 1.45.1 to 1.46.0

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.1 to 1.33.3

Commits

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.1 to 1.20.3

Commits

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.1 to 0.4.3

Commits

Updates github.com/aws/aws-sdk-go-v2/service/ecs from 1.93.0 to 1.96.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/lambda from 1.104.1 to 1.107.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.109.1 to 1.111.0

Commits

Updates github.com/go-playground/validator/v10 from 10.30.3 to 10.30.4

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

v10.30.4

What's Changed

New Contributors

Full Changelog: go-playground/validator@v10.30.3...v10.30.4

Commits
  • dfe35cf ci: Fix the linter version (#1617)
  • facf128 feat(translations): add Armenian translations (#1604)
  • 961375b docs: clarify fieldexcludes behavior (#1610)
  • 74dd82a test: cover startsnotwith/endsnotwith, RegisterStructValidationMapRules, and ...
  • 379edc8 chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#1612)
  • f9944c5 fix: use idiomatic "at most" in English max/lte messages (#1600)
  • 67e37d6 fix(fqdn): enforce maximum DNS name length (#1603)
  • 6b571d1 chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.15 (#...
  • 8455180 chore(deps): bump github.com/leodido/go-urn from 1.4.0 to 1.5.0 (#1606)
  • fd8bd3c chore(deps): bump actions/setup-go from 6 to 7 (#1601)
  • Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.55.0 to 1.56.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.56.0

1.56.0

Changelog

  • GET /containers/json now supports an annotation filter to filter containers by annotation, either by key (annotation=key) or by key and value (annotation="key=value"), similar to the existing label filter. moby/moby#53538
  • POST /containers/create now supports HostConfig.Umask to set the initial umask for a Unix container. When set, the daemon includes the value in the OCI process configuration for the container's entrypoint, exec processes, and healthchecks. When omitted, the runtime's default behavior applies.moby/moby#53463
  • api/docs: sync API docs v1.25 - v1.55. moby/moby#53246
  • api/swagger: Align Healthcheck name with Go struct. moby/moby#53567
  • api/types/plugin: Deprecated plugin.Privileges sorting methods in favor of slices.SortFunc. moby/moby#53511
  • api/types/plugin: fix Privileges Swap implementation. moby/moby#53510
  • api: Bump to 1.56. moby/moby#53425
  • api: document Task.NetworksAttachments in the swagger definition. moby/moby#53082
  • api: remove gotest.tools from tests. moby/moby#53535
  • api: swagger: Use int64 for build query params. moby/moby#53520
  • api: use blackbox testing. moby/moby#53525
  • Fix API reference documenting an unsupported names filter for GET /configs. moby/moby#53447
Commits
  • 9b2179d Merge pull request #53572 from vvoland/api-docs-cut
  • 575cf82 Merge pull request #53571 from thaJeztah/bump_tools
  • 20beedb api/docs: Cut v1.56
  • bb86302 Merge pull request #53569 from vvoland/afvsock-lsm
  • 65be55a Merge pull request #53513 from thaJeztah/daemon_fix_list
  • 0af79c4 Merge pull request #53570 from vvoland/process-release
  • 7d1ce6a Merge pull request #53568 from renovate-bot/renovate/github.com-mdlayher-sock...
  • 0df1a00 Dockerfile: update cli v29.7.2, compose v5.5.1, buildx v0.37.0
  • e1d06bd Drop replace rules
  • b40d37e Merge pull request #53359 from vvoland/ext-namegenerator
  • Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.5.1 to 0.6.0

Release notes

Sourced from github.com/moby/moby/client's releases.

client/v0.6.0

0.6.0

Changelog

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.6.0 (2013-08-22)

  • Runtime: Load authConfig only when needed and fix useless WARNING
  • Runtime: Add lxc-conf flag to allow custom lxc options
  • Runtime: Fix race conditions in parallel pull
  • Runtime: Improve CMD, ENTRYPOINT, and attach docs.
  • Documentation: Small fix to docs regarding adding docker groups
  • Documentation: Add MongoDB image example
  • Builder: Add USER instruction do Dockerfile
  • Documentation: updated default -H docs
  • Remote API: Sort Images by most recent creation date.
  • Builder: Add workdir support for the Buildfile
  • Runtime: Add an option to set the working directory
  • Runtime: Show tag used when image is missing
  • Documentation: Update readme with dependencies for building
  • Documentation: Add instructions for creating and using the docker group
  • Remote API: Reworking opaque requests in registry module
  • Runtime: Fix Graph ByParent() to generate list of child images per parent image.
  • Runtime: Add Image name to LogEvent tests
  • Documentation: Add sudo to examples and installation to documentation
  • Hack: Bash Completion: Limit commands to containers of a relevant state
  • Remote API: Add image name in /events
  • Runtime: Apply volumes-from before creating volumes
  • Runtime: Make docker run handle SIGINT/SIGTERM
  • Runtime: Prevent crash when .dockercfg not readable
  • Hack: Add docker dependencies coverage testing into docker-ci
  • Runtime: Add -privileged flag and relevant tests, docs, and examples
  • Packaging: Docker-brew 0.5.2 support and memory footprint reduction
  • Runtime: Install script should be fetched over https, not http.
  • Packaging: Add new docker dependencies into docker-ci
  • Runtime: Use Go 1.1.2 for dockerbuilder
  • Registry: Improve auth push
  • Runtime: API, issue 1471: Use groups for socket permissions
  • Documentation: PostgreSQL service example in documentation
  • Contrib: bash completion script
  • Tests: Improve TestKillDifferentUser to prevent timeout on buildbot
  • Documentation: Fix typo in docs for docker run -dns
  • Documentation: Adding a reference to ps -a
  • Runtime: Correctly detect IPv4 forwarding
  • Packaging: Revert "docker.upstart: avoid spawning a sh process"
  • Runtime: Use ranged for loop on channels
  • Runtime: Fix typo: fmt.Sprint -> fmt.Sprintf
  • Tests: Fix typo in TestBindMounts (runContainer called without image)
  • Runtime: add websocket support to /container//attach/ws
  • Runtime: Mount /dev/shm as a tmpfs
  • Builder: Only count known instructions as build steps
  • Builder: Fix docker build and docker events output
  • Runtime: switch from http to https for get.docker.io
  • Tests: Improve TestGetContainersTop so it does not rely on sleep
  • Packaging: Docker-brew and Docker standard library
  • Testing: Add some tests in server and utils

... (truncated)

Commits
  • f4a4f1c Bump to 0.6.0
  • f925edd Merge pull request #1525 from griff/1503-fix
  • 12715c8 Merge pull request #1609 from jpetazzo/release-docker-with-docker
  • 326dadd Merge pull request #1565 from dotcloud/only_load_authconfig_when_needed
  • a3510c9 Merge pull request #1560 from dotcloud/439-allow-lxc-args
  • 262d57e Merge pull request #1623 from mhennings/1592-fix-race-conditions-in-parallel-...
  • 551092f Add lxc-conf flag to allow custom lxc options
  • 3f802f4 Fix race conditions in parallel pull
  • 0b9c8e2 Merge pull request #1596 from metalivedev/1149-easyfixes
  • 42fe550 Merge pull request #1614 from denibertovic/docs
  • Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa from 1.20.1 to 1.20.2

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.20.2

This release includes a bug fix for a parser regression introduced in v1.20.0, and dependency updates.

Fix stale parse errors on statements starting with { (#9140)

When the and/or keywords added in v1.20.0 are imported, a statement that starts with { is first read as an explicit operand body, and re-read as a term (a comprehension, for example) if no and or or follows. Errors recorded during the abandoned first attempt stayed in the parser's term cache and were reported against the successful re-read, rejecting policies that parse fine:

package example
import future.keywords
xs := [1, 2, 3]
allow if {
{
y |
some y in xs # rego_parse_error: unexpected some keyword
} == {1, 2, 3}
}

The term cache is now restored along with the rest of the parser state when the operand-body guess is abandoned. Only policies importing and or or — directly or via import future.keywords — were affected; policies that don't import them parse unchanged.

Authored by @​sspaink

Miscellaneous

  • build(go): Bump to 1.27.1 (3652eeb) authored by @​srenatus
  • Dependency updates; notably:
    • build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
    • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0
    • build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
    • build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
    • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/trace from 1.44.0 to 1.46.0

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.20.2

This release includes a bug fix for a parser regression introduced in v1.20.0, and dependency updates.

Fix stale parse errors on statements starting with { (#9140)

When the and/or keywords added in v1.20.0 are imported, a statement that starts with { is first read as an explicit operand body, and re-read as a term (a comprehension, for example) if no and or or follows. Errors recorded during the abandoned first attempt stayed in the parser's term cache and were reported against the successful re-read, rejecting policies that parse fine:

package example
import future.keywords
xs := [1, 2, 3]
allow if {
{
y |
some y in xs # rego_parse_error: unexpected some keyword
} == {1, 2, 3}
}

The term cache is now restored along with the rest of the parser state when the operand-body guess is abandoned. Only policies importing and or or — directly or via import future.keywords — were affected; policies that don't import them parse unchanged.

Authored by @​sspaink

Miscellaneous

  • build(go): Bump to 1.27.1 (3652eeb) authored by @​srenatus
  • Dependency updates; notably:
    • build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
    • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0
    • build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
    • build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
    • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0

... (truncated)

Commits

Updates golang.org/x/oauth2 from 0.36.0 to 0.37.0

Commits
  • c624b89 google: change the snake case endpoint to kebab-case
  • 09a82f6 all: upgrade go directive to at least 1.26.0 [generated]
  • See full diff in compare view

Updates google.golang.org/api from 0.295.0 to 0.297.0

Release notes

Sourced from google.golang.org/api's releases.

v0.297.0

0.297.0 (2026-09-01)

Features

  • Move to go1.26.0 as the lowest supported go version (#3724) (7770e01)

v0.296.0

0.296.0 (2026-08-31)

Features

Changelog

Sourced from google.golang.org/api's changelog.

0.297.0 (2026-09-01)

Features

  • Move to go1.26.0 as the lowest supported go version (#3724) (7770e01)

0.296.0 (2026-08-31)

Features

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the go-dependencies group across 1 directory with 1…
e803fdc 
…3 updates

Bumps the go-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.45.1` | `1.46.0` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.1` | `1.33.3` |
| [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2) | `0.4.1` | `0.4.3` |
| [github.com/aws/aws-sdk-go-v2/service/ecs](https://github.com/aws/aws-sdk-go-v2) | `1.93.0` | `1.96.0` |
| [github.com/aws/aws-sdk-go-v2/service/lambda](https://github.com/aws/aws-sdk-go-v2) | `1.104.1` | `1.107.0` |
| [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) | `10.30.3` | `10.30.4` |
| [github.com/moby/moby/api](https://github.com/moby/moby) | `1.55.0` | `1.56.0` |
| [github.com/moby/moby/client](https://github.com/moby/moby) | `0.5.1` | `0.6.0` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.20.1` | `1.20.2` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.36.0` | `0.37.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.295.0` | `0.297.0` |



Updates `github.com/aws/aws-sdk-go-v2` from 1.45.1 to 1.46.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.45.1...v1.46.0)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.1 to 1.33.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.33.1...config/v1.33.3)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.20.1 to 1.20.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.20.1...v1.20.3)

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager` from 0.4.1 to 0.4.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@feature/s3/transfermanager/v0.4.1...feature/s3/transfermanager/v0.4.3)

Updates `github.com/aws/aws-sdk-go-v2/service/ecs` from 1.93.0 to 1.96.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.93.0...service/s3/v1.96.0)

Updates `github.com/aws/aws-sdk-go-v2/service/lambda` from 1.104.1 to 1.107.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.104.1...service/s3/v1.107.0)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.109.1 to 1.111.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.109.1...service/s3/v1.111.0)

Updates `github.com/go-playground/validator/v10` from 10.30.3 to 10.30.4
- [Release notes](https://github.com/go-playground/validator/releases)
- [Commits](go-playground/validator@v10.30.3...v10.30.4)

Updates `github.com/moby/moby/api` from 1.55.0 to 1.56.0
- [Release notes](https://github.com/moby/moby/releases)
- [Commits](moby/moby@api/v1.55.0...api/v1.56.0)

Updates `github.com/moby/moby/client` from 0.5.1 to 0.6.0
- [Release notes](https://github.com/moby/moby/releases)
- [Changelog](https://github.com/moby/moby/blob/v0.6.0/CHANGELOG.md)
- [Commits](moby/moby@v0.5.1...v0.6.0)

Updates `github.com/open-policy-agent/opa` from 1.20.1 to 1.20.2
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.20.1...v1.20.2)

Updates `golang.org/x/oauth2` from 0.36.0 to 0.37.0
- [Commits](golang/oauth2@v0.36.0...v0.37.0)

Updates `google.golang.org/api` from 0.295.0 to 0.297.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.295.0...v0.297.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.20.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager
  dependency-version: 0.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecs
  dependency-version: 1.96.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/lambda
  dependency-version: 1.107.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.111.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/go-playground/validator/v10
  dependency-version: 10.30.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/moby/moby/api
  dependency-version: 1.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/moby/moby/client
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: google.golang.org/api
  dependency-version: 0.297.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 9, 2026
@github-actions github-actions Bot removed the go Pull requests that update go code label Sep 9, 2026
@claude

claude Bot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @dependabot[bot]'s task in 3m 18s —— View job

Dependency upgrade review

  • Identify changed dependencies
  • Check repo usage of each upgraded dependency
  • Assess breaking/behaviour changes vs. this codebase
  • Verify build / vet — blocked, see note at the bottom
  • Post review

Overall: low risk. Every bump is a minor/patch of a module already in the graph — no modules added or removed, 170/170 line churn is entirely version strings. go.mod already declares go 1.26.7 and .go-version is 1.26, so the new go1.26 floor introduced by google.golang.org/api v0.297.0 and x/oauth2 v0.37.0 is already satisfied.

Two things are worth a check before merge; I've left inline comments on both.

1. go-viper/mapstructure v2.4.0 → v2.5.0 — golden-file risk 🔴

Not listed in the PR description's table, but it's the most likely thing to break. cmd/kosli/snapshotPaths.go:146 uses viper.UnmarshalExact, and cmd/kosli/snapshotPaths_test.go:43 pins mapstructure's unused-keys error text verbatim ('' has invalid keys: foo, versionnn). A wording change upstream breaks that golden.

→ make test_integration_single TARGET=SnapshotPathsTestSuite

2. moby/moby/client v0.5.1 → v0.6.0 — pre-1.0, no API guarantee 🟡

Release notes mention "minor cleanups, refactors" (moby/moby#53509). The repo uses a broad slice of the client surface (client.New, the four Image*Options types, three Container*Options types, ContainerListOptions) across internal/docker/docker.go, internal/digest/digest.go and cmd/kosli/snapshotDocker.go. A clean go build ./... settles it entirely.

Checked and clear

Dependency Assessment
moby/moby/api 1.55→1.56 Changelog is additive (annotation filter, HostConfig.Umask). The one deprecation is plugin.Privileges sort methods; repo only imports api/types/container and api/types/registry.
validator/v10 10.30.3→10.30.4 Behaviour changes are fqdn DNS-length, English max/lte wording, and URN RFC 8141. None apply: internal/server/server.go:27,33,34 uses only required/oneof, and snapshotPaths.go:150 uses the default FieldError.Error(), not the en translator — so the golden at snapshotPaths_test.go:49 is unaffected.
open-policy-agent/opa 1.20.1→1.20.2 Pure bug fix — stale parse errors on statements starting with { when and/or are imported. Strictly widens what parses, so it's a small win for kosli evaluate. internal/evaluate/opa_contract_test.go:478 and cmd/kosli/evaluateInput_test.go:241 read version.Version only for failure messages, no pinned assertion, so no test churn.
AWS SDK (ecs, lambda, s3, config, credentials, core) Generated clients; minor bumps are additive. Core v1.46.0 removed the span retry-loop middleware — tracing internals, and this repo doesn't wire OTel middleware into AWS clients. Worth noting the indirect jumps outpace the direct ones: sso 1.35.1→1.37.0, ssooidc 1.40.1→1.42.0, sts 1.47.1→1.49.0, signin 1.7.1→1.9.0.
feature/s3/transfermanager 0.4.1→0.4.3 Still a v0.x preview module. internal/aws/aws.go:149,567 depends on DownloadObjectInput/DownloadObjectOutput/Options, and internal/aws/fake_s3.go:138 mirrors that signature — the real and fake must move together. Patch-level, so fine, but internal/aws/s3_contract_test.go is the guard worth running.
x/oauth2 0.36→0.37 Only functional change is a Google endpoint snake_case→kebab-case rename. internal/cloudrun/cloudrun.go:108 uses google.DefaultTokenSource; internal/github/github.go:71-76 uses StaticTokenSource/NewClient/Transport. No impact.
google.golang.org/api 0.295→0.297 Regenerated discovery clients + the go1.26 floor (already met).
Remaining indirect (logrus 1.9.4→1.10.2, otel 1.44→1.46, httpsnoop 1.0.4→1.1.0, go-openapi/swag 0.27.1→0.28.0, jwx/v3 3.1.1→3.2.0, grpc-gateway 2.29→2.30, mimetype, go-urn) All pulled transitively via OPA / moby / Google clients; no direct imports in this repo.

Suggested pre-merge checks

go build ./...                                              # covers moby/client v0.6.0
make test_integration_single TARGET=SnapshotPathsTestSuite  # covers mapstructure v2.5.0
make test_integration_single TARGET=SnapshotDockerTestSuite # covers moby api/client
go test ./internal/aws/... ./internal/evaluate/...          # AWS + OPA contract tests

Nit, no action needed: the description's table lists 11 packages while the title says 13, and the changelog links for service/ecs and service/lambda both point at service/s3 compare views — dependabot rendering artifacts, not a problem with the bump itself.

Note on verification: I could not run go build, go vet, or the test suite — the sandbox in this job denied those commands, and the module cache wasn't populated so I couldn't inspect the new moby/client API surface directly either. Everything above is from reading the diff, the upstream changelogs, and this repo's call sites. CI (test.yml) will cover the compile step.
• Branch

@github-actions github-actions Bot added the chore label Sep 9, 2026
claude[bot]
claude Bot reviewed Sep 9, 2026
View reviewed changes
Comment thread go.mod
github.com/go-playground/universal-translator v0.18.1 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect

@claude claude Bot Sep 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Highest-risk bump in this PR, and it isn't in the description's table.

cmd/kosli/snapshotPaths.go:146 decodes the paths spec via viper.UnmarshalExact, which surfaces go-viper/mapstructure's ErrorUnused text verbatim. cmd/kosli/snapshotPaths_test.go:43 asserts that string exactly:

Error: failed to unmarshal path spec file [testdata/paths-files/invalid-pathsfile.yml] : decoding failed due to the following error(s):

'' has invalid keys: foo, versionnn

Any rewording in mapstructure v2.5.0's unused-keys error breaks that golden. Worth running make test_integration_single TARGET=SnapshotPathsTestSuite before merging.

claude[bot]
claude Bot reviewed Sep 9, 2026
View reviewed changes
Comment thread go.mod
github.com/moby/moby/client v0.5.1
github.com/open-policy-agent/opa v1.20.1
github.com/moby/moby/api v1.56.0
github.com/moby/moby/client v0.6.0

@claude claude Bot Sep 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pre-1.0 module, so a minor bump carries no API-stability guarantee, and the release notes list a "minor cleanups, refactors" PR (moby/moby#53509).

This repo leans on a fairly wide slice of that surface:

  • client.New(client.FromEnv) — internal/docker/docker.go:17, internal/digest/digest.go:331, cmd/kosli/snapshotDocker.go:103
  • client.ImagePullOptions / ImagePushOptions / ImageTagOptions / ImageRemoveOptions — internal/docker/docker.go:27,56,82,93
  • client.ContainerCreateOptions / ContainerStartOptions / ContainerRemoveOptions — internal/docker/docker.go:108,119,130
  • client.ContainerListOptions — cmd/kosli/snapshotDocker.go:108

A clean go build ./... fully settles this one — if it compiles, there's nothing further to check here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claude claude[bot] claude[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

chore dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants