Skip to content

build(deps): bump the gomod group across 1 directory with 6 updates - #2636

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-e3df619365
Closed

build(deps): bump the gomod group across 1 directory with 6 updates#2636
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-e3df619365

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the gomod group with 4 updates in the / directory: chainguard.dev/apko, go.opentelemetry.io/otel, go.opentelemetry.io/otel/exporters/stdout/stdouttrace and mvdan.cc/sh/v3.

Updates chainguard.dev/apko from 1.2.39 to 1.2.43

Release notes

Sourced from chainguard.dev/apko's releases.

Release v1.2.43

Changelog

  • 440957e31a268879fb52500c0bcca4fbd18270c2 apk: feed installation from an abstract PackageContents (#2441)
  • eb2d36fedabb189e013e715a638f51fc8162c0d5 build: honor an explicitly empty pre-resolved set; refuse foreign-arc… (#2449)
  • 94dfda0b6d5e3dd53b5bea3feba6fa2d33a0d356 build: install a pre-resolved package list from supplied contents (#2448)

Release v1.2.42

Changelog

  • 7cb86096834d264cd5a8d006275201c6e5f45eb3 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.32 to 1.6.33 (#2438)
  • 713d278889607519d2b66e1e5fe712ec598fccf3 build(deps): bump chainguard.dev/sdk from 0.1.212 to 0.1.213 (#2437)
  • ac58b468d8b98b171d825fb4a0b6789390d8dd8d build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 (#2436)
  • 055231b513c5df6f425703d7549df49e8fe6e88b sbom: make internal SPDX relationships reproducible (#2439)

Release v1.2.41

Changelog

  • 326edceed8d0f8987cde35623be734eadf0cdcc3 apk: expose cache metrics (#2435)
  • d7ffba39ce3a96739af261ced2300c4a9d861d55 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.31 to 1.6.32 (#2421)
  • aeedd74f2113205a720e9c414df18ca1a21fb2c1 build(deps): bump chainguard.dev/sdk from 0.1.197 to 0.1.204 (#2425)
  • c0b1316becd4928e7b7a4cb9122e3c9725fe0df3 build(deps): bump chainguard.dev/sdk from 0.1.204 to 0.1.210 (#2428)
  • c89724f244e9d41f5e14cc7a5f3d0bd08a82128e build(deps): bump chainguard.dev/sdk from 0.1.210 to 0.1.212 (#2434)
  • a2e35acdf791159eac2e1ef9e0b749af605e2535 build(deps): bump github.com/package-url/packageurl-go from 0.1.6 to 0.1.7 (#2430)
  • e202915336e55f7d4b6f464f77bc334726d4c66b build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#2419)
  • 5eab44e4b31ca569b6c08feda482ca3825934aae build(deps): bump go.step.sm/crypto from 0.88.0 to 0.89.0 (#2424)
  • de11e492797f8f0094be458cf435aa4d4bd111fb build(deps): bump k8s.io/apimachinery from 0.36.3 to 0.36.4 (#2429)
  • 1520c603b2f2df983f5ee06af19d0b87b41b41de build(deps): bump step-security/action-actionlint from 1.72.0 to 1.73.1 (#2420)
  • 51d37b413dd5ab8d43f7ea888f701fc87088f517 build(deps): bump the codeql group with 2 updates (#2431)
  • 883c5ad1e3036eebfb75efb5e554976db101493d fix(apk): stop racing on the shared indexOpts authenticator (#2432)
  • 6a223c20c6c14015fdc9554e8ff385e22c5ac4fb go1.27 (#2427)

Release v1.2.40

Changelog

  • d1b5d5ec7633ad7288e5841b38fc8103a9773436 erofs: add 'apko erofs mount' and 'apko erofs umount' (#2415)
Commits
  • eb2d36f build: honor an explicitly empty pre-resolved set; refuse foreign-arc… (#2449)
  • 94dfda0 build: install a pre-resolved package list from supplied contents (#2448)
  • 440957e apk: feed installation from an abstract PackageContents (#2441)
  • 713d278 build(deps): bump chainguard.dev/sdk from 0.1.212 to 0.1.213 (#2437)
  • 7cb8609 build(deps): bump chainguard-dev/actions/setup-registry from 1.6.32 to 1.6.33...
  • ac58b46 build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22....
  • 055231b sbom: make internal SPDX relationships reproducible (#2439)
  • c89724f build(deps): bump chainguard.dev/sdk from 0.1.210 to 0.1.212 (#2434)
  • 326edce apk: expose cache metrics (#2435)
  • 51d37b4 build(deps): bump the codeql group with 2 updates (#2431)
  • Additional commits viewable in compare view

Updates github.com/google/go-containerregistry from 0.21.9 to 0.22.0

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.22.0

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.9...v0.21.10

Commits
  • 3f4ff3c fix(build): unify new build flow into cloudbuild_v2.yaml (#2419)
  • c6b5acd fix(build): correct Cloud Build schema options and source provenance hash (#2...
  • 8f4a85d go.mod: bump Go version + add toolchain directive to replace .go-version file...
  • 5481560 build(deps): bump the go-deps group across 1 directory with 3 updates (#2415)
  • 5b5c272 build(deps): bump the actions group across 1 directory with 8 updates (#2405)
  • 66dd454 remote: retry failed Puller and Pusher initialization (#2406)
  • 3f47f91 fix: add missing substitutions and workspace cleanup to new build files (#2413)
  • 4cb3583 Allow single-character repository paths (#2407)
  • 82cc428 remote: resolve push-check credentials against the repository (#2411)
  • 97815aa build: add multi-architecture Cloud Build configurations for crane, gcrane, a...
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.45.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

  • Support testing of [Go 1.27]. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
Commits
  • 58db4c8 Release v1.46.0 (#8858)
  • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
  • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
  • cfbeab5 attribute: clarify xxhash test purpose (#8753)
  • 3599b59 sdk/log: Add interface stability markers (#8855)
  • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
  • d720f5a otlplog: export dropped attribute count (#8829)
  • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
  • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
  • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.45.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel/exporters/stdout/stdouttrace's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/stdout/stdouttrace's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

  • Support testing of [Go 1.27]. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
Commits
  • 58db4c8 Release v1.46.0 (#8858)
  • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
  • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
  • cfbeab5 attribute: clarify xxhash test purpose (#8753)
  • 3599b59 sdk/log: Add interface stability markers (#8855)
  • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
  • d720f5a otlplog: export dropped attribute count (#8829)
  • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
  • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
  • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/sdk from 1.45.0 to 1.46.0

Release notes

Sourced from go.opentelemetry.io/otel/sdk's releases.

v1.46.0/v0.68.0/v0.22.0/v0.0.19

This release is the last to support Go 1.25. The next release will require at least Go 1.26.

Added

  • Support testing of Go 1.27. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

Added

  • Support testing of [Go 1.27]. (#8811)
  • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
  • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

Changed

  • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
  • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
  • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

Fixed

  • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
  • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
  • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
  • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
  • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
  • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
  • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
  • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
Commits
  • 58db4c8 Release v1.46.0 (#8858)
  • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
  • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
  • cfbeab5 attribute: clarify xxhash test purpose (#8753)
  • 3599b59 sdk/log: Add interface stability markers (

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/gomod-e3df619365 branch 2 times, most recently from c9b5cef to c7c4c7d Compare September 3, 2026 15:23
depthfirst-app[bot]
depthfirst-app Bot reviewed Sep 3, 2026
View reviewed changes
Comment thread go.mod
go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
golang.org/x/mod v0.38.0 // indirect
golang.org/x/net v0.57.0 // indirect
golang.org/x/mod v0.39.0 // indirect

@depthfirst-app depthfirst-app Bot Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Severity: HIGH

The updated indirect golang.org/x/mod v0.39.0 is affected by GO-2026-6179 (CVE-2026-56865) and GO-2026-6180 (CVE-2026-56864). A malicious GOPROXY/GOSUMDB can forge transparency-log responses consumed by sumdb/tlog and sumdb.Client, bypass GOSUMDB, and persist attacker-controlled module content in the local cache, enabling malicious build code.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Upgrade golang.org/x/mod from v0.39.0 to v0.40.0 to remediate GO-2026-6179 (CVE-2026-56865) and GO-2026-6180 (CVE-2026-56864). These vulnerabilities allow a malicious GOPROXY or GOSUMDB to forge transparency-log responses in sumdb/tlog, bypass GOSUMDB integrity checks, and persist attacker-controlled module content in the local cache. After updating go.mod, run go mod tidy to regenerate go.sum with the correct checksums for the new version.

⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.

Suggested change
golang.org/x/mod v0.39.0 // indirect
golang.org/x/mod v0.40.0 // indirect

@dependabot
build(deps): bump the gomod group across 1 directory with 6 updates
372b479 
Bumps the gomod group with 4 updates in the / directory: [chainguard.dev/apko](https://github.com/chainguard-dev/apko), [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go), [go.opentelemetry.io/otel/exporters/stdout/stdouttrace](https://github.com/open-telemetry/opentelemetry-go) and [mvdan.cc/sh/v3](https://github.com/mvdan/sh).


Updates `chainguard.dev/apko` from 1.2.39 to 1.2.43
- [Release notes](https://github.com/chainguard-dev/apko/releases)
- [Changelog](https://github.com/chainguard-dev/apko/blob/main/NEWS.md)
- [Commits](chainguard-dev/apko@v1.2.39...v1.2.43)

Updates `github.com/google/go-containerregistry` from 0.21.9 to 0.22.0
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.9...v0.22.0)

Updates `go.opentelemetry.io/otel` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.45.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.45.0...v1.46.0)

Updates `mvdan.cc/sh/v3` from 3.13.1 to 3.14.0
- [Release notes](https://github.com/mvdan/sh/releases)
- [Changelog](https://github.com/mvdan/sh/blob/master/CHANGELOG.md)
- [Commits](mvdan/sh@v3.13.1...v3.14.0)

---
updated-dependencies:
- dependency-name: chainguard.dev/apko
  dependency-version: 1.2.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: mvdan.cc/sh/v3
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/gomod-e3df619365 branch from c7c4c7d to 372b479 Compare September 4, 2026 15:23
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 7, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/gomod-e3df619365 branch September 7, 2026 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@depthfirst-app depthfirst-app[bot] depthfirst-app[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants