Skip to content

chore(deps): bump the go_modules group across 1 directory with 5 updates#2520

Merged
shino merged 1 commit intomasterfrom
dependabot/go_modules/go_modules-8bd31c9d08
Apr 24, 2026
Merged

chore(deps): bump the go_modules group across 1 directory with 5 updates#2520
shino merged 1 commit intomasterfrom
dependabot/go_modules/go_modules-8bd31c9d08

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 16, 2026 •
edited
Loading

Bumps the go_modules group with 4 updates in the / directory: github.com/go-jose/go-jose/v4, github.com/hashicorp/go-getter, github.com/moby/spdystream and helm.sh/helm/v3.

Updates github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.4

What's Changed

Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8

Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4

Commits

Updates github.com/hashicorp/go-getter from 1.8.3 to 1.8.6

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.8.6

No release notes provided.

v1.8.5

What's Changed

NOTES:

Binary Distribution Update: To streamline our release process and align with other HashiCorp tools, all release binaries will now be published exclusively to the official HashiCorp release site. We will no longer attach release assets to GitHub Releases.

New Contributors

Full Changelog: hashicorp/go-getter@v1.8.4...v1.8.5

v1.8.4

What's Changed

... (truncated)

Commits
  • d23bff4 Merge pull request #608 from hashicorp/dependabot/go_modules/go-security-9c51...
  • 2c4aba8 Merge pull request #613 from hashicorp/pull/v1.8.6
  • fe61ed9 Merge pull request #611 from hashicorp/SECVULN-41053
  • d533656 Merge pull request #606 from hashicorp/pull/CRT
  • 388f23d Additional test for local branch and head
  • b7ceaa5 harden checkout ref handling and added regression tests
  • 769cc14 Release version bump up
  • 6086a6a Review Comments Addressed
  • e02063c Revert "SECVULN Fix for git checkout argument injection enables arbitrary fil...
  • c93084d [chore] : Bump google.golang.org/grpc
  • Additional commits viewable in compare view

Updates github.com/moby/spdystream from 0.5.0 to 0.5.1

Release notes

Sourced from github.com/moby/spdystream's releases.

v0.5.1

What's Changed

Security

Fix memory amplification in SPDY frame parsing leads to denial of service (CVE-2026-35469 / GHSA-pc3f-x583-g7j2)

Changes

Full Changelog: moby/spdystream@v0.5.0...v0.5.1

Commits
  • c59e5d7 Merge pull request #109 from thaJeztah/use_ioutil
  • 2fd0155 use ioutil.Discard for go1.13 compatibility
  • ef6121f Merge commit from fork
  • 241cec9 compare with signed Int for 32-bit Arm
  • 21c3864 Add options to customize limits
  • acf9b45 spdy: update godoc for MaxDataLength
  • eb63605 spdy: limit header-size and header-count
  • 2f21da4 spdy: fix header block byte accounting
  • 5976b66 spdy: enforce 24-bit frame length limits
  • cf0ec5d Guard against oversized SPDY frames
  • Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/sdk from 1.40.0 to 1.42.0

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

  • Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)
  • Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#7924)

Changed

  • TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#7856)

Fixed

  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#7931)
  • Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#7964)
  • Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#7834)

Removed

  • Drop support for [Go 1.24]. (#7984)

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

  • Support testing of [Go 1.26]. (#7902)

Fixed

  • Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)
Commits
  • a3941ff Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (#8006)
  • 6059c47 chore(deps): update golang.org/x/telemetry digest to e526e8a (#8010)
  • 44c7edf chore(deps): update module github.com/mgechev/revive to v1.15.0 (#8009)
  • de5fb3a fix(deps): update module google.golang.org/grpc to v1.79.2 (#8007)
  • 0b82ded chore(deps): update codspeedhq/action action to v4.11.1 (#8001)
  • aa3660f chore(deps): update github/codeql-action action to v4.32.6 (#8004)
  • 9be8c92 chore(deps): update dependency codespell to v2.4.2 (#8003)
  • c9d2015 log: add error field to Record and make SDK to emit exception attributes (#7924)
  • fdd1320 TracerProvider ForceFlush() Error Fix (#7856)
  • 78f9904 chore(deps): update golang.org/x/telemetry digest to 18da590 (#8000)
  • Additional commits viewable in compare view

Updates helm.sh/helm/v3 from 3.19.2 to 3.20.2

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.20.2

v3.20.2

Helm v3.20.2 is a security patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

Installation and Upgrading

Download Helm v3.20.2. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

  • fix: Chart dot-name path bug 8fb76d6ab555577e98e23b7500009537a471feee (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 3a8927e275c50cecde273872dad2a5576bd46375 (Terry Howe)

Helm v3.20.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

... (truncated)

Commits
  • 8fb76d6 fix: Chart dot-name path bug
  • 3a8927e fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow
  • a2369ca chore(deps): bump the k8s-io group with 7 updates
  • 90e1056 add image index test
  • 911f2e9 fix pulling charts from OCI indices
  • 76dad33 Remove refactorring changes from coalesce_test.go
  • 45c12f7 Fix import
  • 26c6f19 Update pkg/chart/common/util/coalesce_test.go
  • 09f5129 Fix lint warning
  • 417deb2 Preserve nil values in chart already
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Apr 16, 2026
@dependabot dependabot Bot mentioned this pull request Apr 16, 2026
Closed
@dependabot
chore(deps): bump the go_modules group across 1 directory with 5 updates
3985bc5 
Bumps the go_modules group with 4 updates in the / directory: [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose), [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter), [github.com/moby/spdystream](https://github.com/moby/spdystream) and [helm.sh/helm/v3](https://github.com/helm/helm).


Updates `github.com/go-jose/go-jose/v4` from 4.1.3 to 4.1.4
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.1.3...v4.1.4)

Updates `github.com/hashicorp/go-getter` from 1.8.3 to 1.8.6
- [Release notes](https://github.com/hashicorp/go-getter/releases)
- [Commits](hashicorp/go-getter@v1.8.3...v1.8.6)

Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1
- [Release notes](https://github.com/moby/spdystream/releases)
- [Commits](moby/spdystream@v0.5.0...v0.5.1)

Updates `go.opentelemetry.io/otel/sdk` from 1.40.0 to 1.42.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.42.0)

Updates `helm.sh/helm/v3` from 3.19.2 to 3.20.2
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v3.19.2...v3.20.2)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.4
  dependency-type: indirect
- dependency-name: github.com/hashicorp/go-getter
  dependency-version: 1.8.6
  dependency-type: indirect
- dependency-name: github.com/moby/spdystream
  dependency-version: 0.5.1
  dependency-type: indirect
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.42.0
  dependency-type: indirect
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.20.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/go_modules-8bd31c9d08 branch from a192e4b to 3985bc5 Compare April 24, 2026 03:15
@shino shino merged commit 71ddc50 into master Apr 24, 2026
8 checks passed
@shino shino deleted the dependabot/go_modules/go_modules-8bd31c9d08 branch April 24, 2026 07:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shino shino shino approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shino