Skip to content

chore(deps): bump the minor-and-patch group with 7 updates - #722

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-518bb18979
Open

chore(deps): bump the minor-and-patch group with 7 updates#722
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-518bb18979

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown

Bumps the minor-and-patch group with 7 updates:

Package From To
github.com/beevik/etree 1.7.0 1.7.1
github.com/go-chi/chi/v5 5.3.1 5.3.2
github.com/mattn/go-sqlite3 1.14.49 1.14.50
github.com/minio/minio-go/v7 7.2.1 7.3.0
github.com/prometheus/alertmanager 0.33.1 0.34.0
github.com/stretchr/testify 1.11.1 1.12.1
google.golang.org/grpc 1.83.0 1.83.1

Updates github.com/beevik/etree from 1.7.0 to 1.7.1

Release notes

Sourced from github.com/beevik/etree's releases.

Release v1.7.1

Changes

  • Improve efficiency of Element.Text and Element.Tail.
Changelog

Sourced from github.com/beevik/etree's changelog.

Release 1.7.1

Changes

  • Improve efficiency of Element.Text and Element.Tail.
Commits

Updates github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.2

What's Changed

  • feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in go-chi/chi#1151
  • docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in go-chi/chi#1111
  • fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in go-chi/chi#1148
  • Don't duplicate methods in Allow: header for 405 responses by @​flimzy in go-chi/chi#1029
  • fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in go-chi/chi#1156
    • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in go-chi/chi#868 and go-chi/chi#1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

Commits
  • 3893906 fix(middleware): reject catch-all compress wildcards "/" and "/*" (#1156)
  • 9b6ddcd Don't duplicate methods in Allow: header for 405 responses (#1029)
  • 29164f0 fix: don't drop handlers that collide with a Mount()/Route() pattern (#1148)
  • bc02284 docs: deployment recipe + verify checklist for ClientIPFromXFFTrustedProxies ...
  • 60ecea5 feat(middleware): add text/markdown, text/csv, text/vtt to default compressib...
  • See full diff in compare view

Updates github.com/mattn/go-sqlite3 from 1.14.49 to 1.14.50

Release notes

Sourced from github.com/mattn/go-sqlite3's releases.

1.14.50

What's Changed

New Contributors

Full Changelog: mattn/go-sqlite3@v1.14.49...v1.14.50

Commits
  • 58c8e14 Merge pull request #1446 from 0xCarbon/fix/vtable-destroy-handle
  • e27b5e9 fix: keep vtab handle registered when xDestroy fails
  • f9fc7aa Merge pull request #1443 from mattn/add-release-workflow
  • a93a209 Fail closed on release lookup errors and serialize runs per tag
  • 485f31f Add workflow to create releases on tag push
  • 9415230 Merge pull request #1441 from mattn/fix-json-example-scan
  • 88a4797 Handle NULL and BLOB values in json example Scan
  • See full diff in compare view

Updates github.com/minio/minio-go/v7 from 7.2.1 to 7.3.0

Release notes

Sourced from github.com/minio/minio-go/v7's releases.

v7.3.0

What's Changed

New Contributors

Full Changelog: minio/minio-go@v7.2.1...v7.3.0

Commits
  • ce0e323 update lib version to v7.3.0
  • 2f55211 rdma: build against libs3rdma, and fix the size guard's off-by-one (#2283)
  • 1e3d492 feat: propagate caller context through credential providers (#2275)
  • e7b0801 Add AIStor Lifecycle Compression (#2281)
  • b15d168 build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#2280)
  • d1e1ecd fix: return delete-marker ObjectInfo from StatObject alongside the error (#2273)
  • f230068 fix: declare aws-chunked content encoding on streaming uploads (#2277)
  • 90530cf Add end-to-end checksum verification on GetObject (#2272)
  • a4c24f9 build(deps): bump the actions group with 2 updates (#2279)
  • 28bece5 rdma: reject buffers over the 4 GiB cuObject registration limit (#2278)
  • Additional commits viewable in compare view

Updates github.com/prometheus/alertmanager from 0.33.1 to 0.34.0

Release notes

Sourced from github.com/prometheus/alertmanager's releases.

0.34.0 / 2026-08-16

  • [CHANGE] notify: The reason label on alertmanager_notifications_failed_total now distinguishes authError (HTTP 401/403) and rateLimited (HTTP 429) from the generic clientError. Dashboards/alerts matching reason="clientError" for these codes must be updated. #5332
  • [FEATURE] Add optional templatable labels to alert routes. #5328
  • [FEATURE] eventrecorder: Add inhibit rule names to inhibition_muted_alert events. #5315
  • [FEATURE] eventrecorder: Add stdout output type. #5311
  • [FEATURE] silences: Add active, expired, and pending boolean filter parameters to GET /api/v2/silences to allow filtering silences by state server-side. #5406
  • [FEATURE] sns: Add aws external_id support in sigv4 configuration. #5157
  • [FEATURE] template: Add toDate and mustToDate functions. #5327
  • [ENHANCEMENT] doc: Add AlertmanagerClusterFailedPeers alertmanager-mixin. #5301
  • [ENHANCEMENT] doc: Add description for Rocketchat parameters in global config. #5181
  • [ENHANCEMENT] doc: Add top level tracing configuration key. #5314
  • [ENHANCEMENT] doc: Fix Alertmanager port in amtool config routes example. #5312
  • [ENHANCEMENT] eventrecorder: Add optional webhook batching. #5392
  • [ENHANCEMENT] notify: The discord and webex integrations now report a failure reason on alertmanager_notifications_failed_total. #5332
  • [ENHANCEMENT] ui: Improve responsiveness of UI when loading thousands of alerts. #5357
  • [BUGFIX] eventrecorder: Fixed a minor performance regression when the event recorder is enabled. #5307
  • [BUGFIX] msteamsv2: Inherit global proxy_url into partial http_config. #5379
  • [BUGFIX] webhook: Keep custom payload string values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #5304
Changelog

Sourced from github.com/prometheus/alertmanager's changelog.

0.34.0 / 2026-08-16

  • [CHANGE] notify: The reason label on alertmanager_notifications_failed_total now distinguishes authError (HTTP 401/403) and rateLimited (HTTP 429) from the generic clientError. Dashboards/alerts matching reason="clientError" for these codes must be updated. #5332
  • [FEATURE] Add optional templatable labels to alert routes. #5328
  • [FEATURE] eventrecorder: Add inhibit rule names to inhibition_muted_alert events. #5315
  • [FEATURE] eventrecorder: Add stdout output type. #5311
  • [FEATURE] silences: Add active, expired, and pending boolean filter parameters to GET /api/v2/silences to allow filtering silences by state server-side. #5406
  • [FEATURE] sns: Add aws external_id support in sigv4 configuration. #5157
  • [FEATURE] template: Add toDate and mustToDate functions. #5327
  • [ENHANCEMENT] doc: Add AlertmanagerClusterFailedPeers alertmanager-mixin. #5301
  • [ENHANCEMENT] doc: Add description for Rocketchat parameters in global config. #5181
  • [ENHANCEMENT] doc: Add top level tracing configuration key. #5314
  • [ENHANCEMENT] doc: Fix Alertmanager port in amtool config routes example. #5312
  • [ENHANCEMENT] eventrecorder: Add optional webhook batching. #5392
  • [ENHANCEMENT] notify: The discord and webex integrations now report a failure reason on alertmanager_notifications_failed_total. #5332
  • [ENHANCEMENT] ui: Improve responsiveness of UI when loading thousands of alerts. #5357
  • [BUGFIX] eventrecorder: Fixed a minor performance regression when the event recorder is enabled. #5307
  • [BUGFIX] msteamsv2: Inherit global proxy_url into partial http_config. #5379
  • [BUGFIX] webhook: Keep custom payload string values verbatim instead of reinterpreting JSON leaves that look like YAML (e.g. values ending with a colon). #5304
Commits
  • 085f0ef Release v0.34.0 (#5453)
  • 55d0d79 build(deps-dev): bump the testing group across 1 directory with 4 updates (#5...
  • 865dcf4 build(deps-dev): bump the vite group across 1 directory with 2 updates (#5424)
  • 0f8855c build(deps): bump github.com/oklog/ulid/v2 from 2.1.1 to 2.1.2 (#5434)
  • 5d2efff build(deps): bump the react group across 1 directory with 5 updates (#5444)
  • b9914e6 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#5420)
  • 5cd990f build(deps): bump @​tanstack/react-query from 5.101.2 to 5.101.4 in /ui/mantin...
  • e9a6078 Synchronize common files from prometheus/prometheus (#5439)
  • a5a81c0 build(deps-dev): bump postcss from 8.5.16 to 8.5.25 in /ui/mantine-ui in the ...
  • 5f33ec5 build(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 (...
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.83.0 to 1.83.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.1

Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

Performance

  • transport: Restrict memory overhead of buffering small data frames. (#9331)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group with 7 updates
89dc070 
Bumps the minor-and-patch group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/beevik/etree](https://github.com/beevik/etree) | `1.7.0` | `1.7.1` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.3.1` | `5.3.2` |
| [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.49` | `1.14.50` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.2.1` | `7.3.0` |
| [github.com/prometheus/alertmanager](https://github.com/prometheus/alertmanager) | `0.33.1` | `0.34.0` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.83.0` | `1.83.1` |


Updates `github.com/beevik/etree` from 1.7.0 to 1.7.1
- [Release notes](https://github.com/beevik/etree/releases)
- [Changelog](https://github.com/beevik/etree/blob/main/RELEASE_NOTES.md)
- [Commits](beevik/etree@v1.7.0...v1.7.1)

Updates `github.com/go-chi/chi/v5` from 5.3.1 to 5.3.2
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.3.1...v5.3.2)

Updates `github.com/mattn/go-sqlite3` from 1.14.49 to 1.14.50
- [Release notes](https://github.com/mattn/go-sqlite3/releases)
- [Commits](mattn/go-sqlite3@v1.14.49...v1.14.50)

Updates `github.com/minio/minio-go/v7` from 7.2.1 to 7.3.0
- [Release notes](https://github.com/minio/minio-go/releases)
- [Commits](minio/minio-go@v7.2.1...v7.3.0)

Updates `github.com/prometheus/alertmanager` from 0.33.1 to 0.34.0
- [Release notes](https://github.com/prometheus/alertmanager/releases)
- [Changelog](https://github.com/prometheus/alertmanager/blob/main/CHANGELOG.md)
- [Commits](prometheus/alertmanager@v0.33.1...v0.34.0)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

Updates `google.golang.org/grpc` from 1.83.0 to 1.83.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.0...v1.83.1)

---
updated-dependencies:
- dependency-name: github.com/beevik/etree
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/mattn/go-sqlite3
  dependency-version: 1.14.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/minio/minio-go/v7
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/prometheus/alertmanager
  dependency-version: 0.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 23, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 23, 2026 22:04
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 23, 2026
@kw-security

kw-security commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kw-security