Skip to content

build(deps): bump the gomod group across 1 directory with 6 updates - #2636

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-e3df619365
Open

build(deps): bump the gomod group across 1 directory with 6 updates#2636
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-e3df619365

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the gomod group with 4 updates in the / directory: chainguard.dev/apko, go.opentelemetry.io/otel, go.opentelemetry.io/otel/exporters/stdout/stdouttrace and mvdan.cc/sh/v3.

Updates chainguard.dev/apko from 1.2.39 to 1.2.43

Release notes

Sourced from chainguard.dev/apko's releases.

Release v1.2.43

Changelog

  • 440957e31a268879fb52500c0bcca4fbd18270c2 apk: feed installation from an abstract PackageContents (#2441)
  • eb2d36fedabb189e013e715a638f51fc8162c0d5 build: honor an explicitly empty pre-resolved set; refuse foreign-arc… (#2449)
  • 94dfda0b6d5e3dd53b5bea3feba6fa2d33a0d356 build: install a pre-resolved package list from supplied contents (#2448)

Release v1.2.42

Changelog

  • 7cb86096834d264cd5a8d006275201c6e5f45eb3 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.32 to 1.6.33 (#2438)
  • 713d278889607519d2b66e1e5fe712ec598fccf3 build(deps): bump chainguard.dev/sdk from 0.1.212 to 0.1.213 (#2437)
  • ac58b468d8b98b171d825fb4a0b6789390d8dd8d build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 (#2436)
  • 055231b513c5df6f425703d7549df49e8fe6e88b sbom: make internal SPDX relationships reproducible (#2439)

Release v1.2.41

Changelog

  • 326edceed8d0f8987cde35623be734eadf0cdcc3 apk: expose cache metrics (#2435)
  • d7ffba39ce3a96739af261ced2300c4a9d861d55 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.31 to 1.6.32 (#2421)
  • aeedd74f2113205a720e9c414df18ca1a21fb2c1 build(deps): bump chainguard.dev/sdk from 0.1.197 to 0.1.204 (#2425)
  • c0b1316becd4928e7b7a4cb9122e3c9725fe0df3 build(deps): bump chainguard.dev/sdk from 0.1.204 to 0.1.210 (#2428)
  • c89724f244e9d41f5e14cc7a5f3d0bd08a82128e build(deps): bump chainguard.dev/sdk from 0.1.210 to 0.1.212 (#2434)
  • a2e35acdf791159eac2e1ef9e0b749af605e2535 build(deps): bump github.com/package-url/packageurl-go from 0.1.6 to 0.1.7 (#2430)
  • e202915336e55f7d4b6f464f77bc334726d4c66b build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#2419)
  • 5eab44e4b31ca569b6c08feda482ca3825934aae build(deps): bump go.step.sm/crypto from 0.88.0 to 0.89.0 (#2424)
  • de11e492797f8f0094be458cf435aa4d4bd111fb build(deps): bump k8s.io/apimachinery from 0.36.3 to 0.36.4 (#2429)
  • 1520c603b2f2df983f5ee06af19d0b87b41b41de build(deps): bump step-security/action-actionlint from 1.72.0 to 1.73.1 (#2420)
  • 51d37b413dd5ab8d43f7ea888f701fc87088f517 build(deps): bump the codeql group with 2 updates (#2431)
  • 883c5ad1e3036eebfb75efb5e554976db101493d fix(apk): stop racing on the shared indexOpts authenticator (#2432)
  • 6a223c20c6c14015fdc9554e8ff385e22c5ac4fb go1.27 (#2427)

Release v1.2.40

Changelog

  • d1b5d5ec7633ad7288e5841b38fc8103a9773436 erofs: add 'apko erofs mount' and 'apko erofs umount' (#2415)
Commits
  • eb2d36f build: honor an explicitly empty pre-resolved set; refuse foreign-arc… (#2449)
  • 94dfda0 build: install a pre-resolved package list from supplied contents (#2448)
  • 440957e apk: feed installation from an abstract PackageContents (#2441)
  • 713d278 build(deps): bump chainguard.dev/sdk from 0.1.212 to 0.1.213 (#2437)
  • 7cb8609 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.32 to 1.6.33...
  • ac58b46 build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22....
  • 055231b sbom: make internal SPDX relationships reproducible (#2439)
  • c89724f build(deps): bump chainguard.dev/sdk from 0.1.210 to 0.1.212 (#2434)
  • 326edce apk: expose cache metrics (#2435)
  • 51d37b4 build(deps): bump the codeql group with 2 updates (#2431)
  • Additional commits viewable in compare view

Updates github.com/google/go-containerregistry from 0.21.9 to 0.22.0

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.22.0

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.9...v0.21.10

Commits
  • 3f4ff3c fix(build): unify new build flow into cloudbuild_v2.yaml (#2419)
  • c6b5acd fix(build): correct Cloud Build schema options and source provenance hash (#2...
  • 8f4a85d go.mod: bump Go version + add toolchain directive to replace .go-version file...
  • 5481560 build(deps): bump the go-deps group across 1 directory with 3 updates (#2415)
  • 5b5c272 build(deps): bump the actions group across 1 directory with 8 updates (#2405)
  • 66dd454 remote: retry failed Puller and Pusher initialization (#2406)
  • 3f47f91 fix: add missing substitutions and workspace cleanup to new build files (#2413)
  • 4cb3583 Allow single-character repository paths (#2407)
  • 82cc428 remote: resolve push-check credentials against the repository (#2411)
  • 97815aa build: add multi-architecture Cloud Build configurations for crane, gcrane, a...
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.45.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

  • Support testing of [Go 1.27]. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
Commits
  • 58db4c8 Release v1.46.0 (#8858)
  • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
  • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
  • cfbeab5 attribute: clarify xxhash test purpose (#8753)
  • 3599b59 sdk/log: Add interface stability markers (#8855)
  • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
  • d720f5a otlplog: export dropped attribute count (#8829)
  • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
  • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
  • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.45.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel/exporters/stdout/stdouttrace's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/stdout/stdouttrace's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

  • Support testing of [Go 1.27]. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
Commits
  • 58db4c8 Release v1.46.0 (#8858)
  • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
  • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
  • cfbeab5 attribute: clarify xxhash test purpose (#8753)
  • 3599b59 sdk/log: Add interface stability markers (#8855)
  • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
  • d720f5a otlplog: export dropped attribute count (#8829)
  • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
  • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
  • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/sdk from 1.45.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel/sdk's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

  • Support testing of [Go 1.27]. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
Commits
  • 58db4c8 Release v1.46.0 (#8858)
  • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
  • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
  • cfbeab5 attribute: clarify xxhash test purpose (#8753)
  • 3599b59 sdk/log: Add interface stability markers (

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/gomod-e3df619365 branch 2 times, most recently from c9b5cef to c7c4c7d Compare September 3, 2026 15:23
depthfirst-app[bot]
depthfirst-app Bot reviewed Sep 3, 2026
View reviewed changes
Comment thread go.mod
go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
golang.org/x/mod v0.38.0 // indirect
golang.org/x/net v0.57.0 // indirect
golang.org/x/mod v0.39.0 // indirect

@depthfirst-app depthfirst-app Bot Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Severity: HIGH

The updated indirect golang.org/x/mod v0.39.0 is affected by GO-2026-6179 (CVE-2026-56865) and GO-2026-6180 (CVE-2026-56864). A malicious GOPROXY/GOSUMDB can forge transparency-log responses consumed by sumdb/tlog and sumdb.Client, bypass GOSUMDB, and persist attacker-controlled module content in the local cache, enabling malicious build code.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Upgrade golang.org/x/mod from v0.39.0 to v0.40.0 to remediate GO-2026-6179 (CVE-2026-56865) and GO-2026-6180 (CVE-2026-56864). These vulnerabilities allow a malicious GOPROXY or GOSUMDB to forge transparency-log responses in sumdb/tlog, bypass GOSUMDB integrity checks, and persist attacker-controlled module content in the local cache. After updating go.mod, run go mod tidy to regenerate go.sum with the correct checksums for the new version.

⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.

Suggested change
golang.org/x/mod v0.39.0 // indirect
golang.org/x/mod v0.40.0 // indirect

@dependabot
build(deps): bump the gomod group across 1 directory with 6 updates
372b479 
Bumps the gomod group with 4 updates in the / directory: [chainguard.dev/apko](https://github.com/chainguard-dev/apko), [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go), [go.opentelemetry.io/otel/exporters/stdout/stdouttrace](https://github.com/open-telemetry/opentelemetry-go) and [mvdan.cc/sh/v3](https://github.com/mvdan/sh).


Updates `chainguard.dev/apko` from 1.2.39 to 1.2.43
- [Release notes](https://github.com/chainguard-dev/apko/releases)
- [Changelog](https://github.com/chainguard-dev/apko/blob/main/NEWS.md)
- [Commits](chainguard-dev/apko@v1.2.39...v1.2.43)

Updates `github.com/google/go-containerregistry` from 0.21.9 to 0.22.0
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.9...v0.22.0)

Updates `go.opentelemetry.io/otel` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `mvdan.cc/sh/v3` from 3.13.1 to 3.14.0
- [Release notes](https://github.com/mvdan/sh/releases)
- [Changelog](https://github.com/mvdan/sh/blob/master/CHANGELOG.md)
- [Commits](mvdan/sh@v3.13.1...v3.14.0)

---
updated-dependencies:
- dependency-name: chainguard.dev/apko
  dependency-version: 1.2.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: mvdan.cc/sh/v3
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/gomod-e3df619365 branch from c7c4c7d to 372b479 Compare September 4, 2026 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@depthfirst-app depthfirst-app[bot] depthfirst-app[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants