Skip to content

build(deps): bump the go-minor-patch group across 1 directory with 13 updates - #11

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/backend/go-minor-patch-04f56169d4
Closed

build(deps): bump the go-minor-patch group across 1 directory with 13 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/backend/go-minor-patch-04f56169d4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-minor-patch group with 11 updates in the /backend directory:

Package From To
github.com/fatih/color 1.18.0 1.19.0
github.com/go-chi/chi/v5 5.1.0 5.3.2
github.com/go-chi/cors 1.2.1 1.2.2
github.com/go-chi/httprate 0.14.1 0.16.0
github.com/go-webauthn/webauthn 0.17.4 0.18.0
github.com/jackc/pgx/v5 5.9.2 5.10.0
github.com/minio/minio-go/v7 7.0.76 7.3.0
github.com/rs/zerolog 1.34.0 1.35.1
github.com/spf13/viper 1.19.0 1.21.0
github.com/tus/tusd/v2 2.9.2 2.10.0
golang.org/x/image 0.43.0 0.45.0

Updates github.com/fatih/color from 1.18.0 to 1.19.0

Release notes

Sourced from github.com/fatih/color's releases.

v1.19.0

What's Changed

New Contributors

Full Changelog: fatih/color@v1.18.0...v1.19.0

Commits
  • ca25f6e Merge pull request #266 from fatih/dependabot/github_actions/actions/setup-go-6
  • 1205984 Bump actions/setup-go from 5 to 6
  • 5715c20 Merge pull request #269 from UnSubble/main
  • 2f6e200 Merge branch 'main' into main
  • f72ec94 Merge pull request #273 from fatih/dependabot/github_actions/actions/checkout-6
  • 848e633 Merge branch 'main' into main
  • 4c2cd34 Add tests
  • 7f812f0 Bump actions/checkout from 4 to 6
  • b7fc9f9 Merge pull request #259 from fatih/dependabot/github_actions/dominikh/staticc...
  • 239a88f Bump dominikh/staticcheck-action from 1.3.1 to 1.4.0
  • Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.1.0 to 5.3.2

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.2

What's Changed

  • feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in go-chi/chi#1151
  • docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in go-chi/chi#1111
  • fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in go-chi/chi#1148
  • Don't duplicate methods in Allow: header for 405 responses by @​flimzy in go-chi/chi#1029
  • fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in go-chi/chi#1156
    • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in go-chi/chi#868 and go-chi/chi#1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

v5.3.1

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

v5.3.0

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

... (truncated)

Commits
  • 3893906 fix(middleware): reject catch-all compress wildcards "/" and "/*" (#1156)
  • 9b6ddcd Don't duplicate methods in Allow: header for 405 responses (#1029)
  • 29164f0 fix: don't drop handlers that collide with a Mount()/Route() pattern (#1148)
  • bc02284 docs: deployment recipe + verify checklist for ClientIPFromXFFTrustedProxies ...
  • 60ecea5 feat(middleware): add text/markdown, text/csv, text/vtt to default compressib...
  • 8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
  • caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
  • 7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
  • 878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
  • d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
  • Additional commits viewable in compare view

Updates github.com/go-chi/cors from 1.2.1 to 1.2.2

Release notes

Sourced from github.com/go-chi/cors's releases.

v1.2.2

What's Changed

New Contributors

Full Changelog: go-chi/cors@v1.2.1...v1.2.2

Commits

Updates github.com/go-chi/httprate from 0.14.1 to 0.16.0

Release notes

Sourced from github.com/go-chi/httprate's releases.

v0.16.0

What's Changed

New Contributors

Full Changelog: go-chi/httprate@v0.15.0...v0.16.0

v0.15.0

  • upgrade to xxhash v3
Commits
  • 741b4a5 Deprecate spoofable RealIP rate-limiting; add LimitBy + KeyFromContext and mo...
  • 81255de perf: use zero-alloc xxh3.HashString on the local counter hot path (#60)
  • 0c2093a test: replace golang.org/x/sync/errgroup with sync.WaitGroup (#59)
  • 89e5cca local counter: align windows to reset at sub-millisecond counter start (#58)
  • be2ba84 replace fmt with strconv to reduce allocations (#55)
  • c0b6272 upgrade to xxh3 hashing pkg (#54)
  • 9d627fb Update README.md: add missing 'time' import in code example (#49)
  • 24ebb38 Try to fix Github action access issue (#51)
  • See full diff in compare view

Updates github.com/go-webauthn/webauthn from 0.17.4 to 0.18.0

Release notes

Sourced from github.com/go-webauthn/webauthn's releases.

v0.18.0

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int https://github.com/go-webauthn/webauthn/blob/HEAD/MIGRATION.md as they are substantial between ths version and prior versions.

Bug Fixes

  • metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
  • metadata: consistent revocation policy and client timeouts (#740) (34d324b)
  • metadata: handle certificate chains of any depth (#737) (309ea69)
  • metadata: honour status report order and effective dates (#736) (8be5355)
  • metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
  • metadata: prevent panic corrupt blob (#698) (c5fd013)
  • metadata: report malformed status report urls (#738) (ed82f7c)
  • protocol: allow any attestation eku (#728) (f4e33fc)
  • protocol: androidkey missing authorization list member (#727) (9b02b19)
  • protocol: androidkey union generated (#729) (3ed3e75)
  • protocol: bind credential public key curve to its algorithm (#752) (314c2be)
  • protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
  • protocol: compound returns incorrect type (#731) (025d897)
  • protocol: credential public key match limited to ECDSA (#732) (b4df26e)
  • protocol: harden credential response and options handling (#763) (de0ae6c)
  • protocol: missing tpm steps (#725) (f9a63f9)
  • protocol: opaque origin matching and validation (#758) (37f065a)
  • protocol: possible panic conditions (#719) (0ea14e7)
  • protocol: safetynet validation steps (#726) (e12f6e8)
  • protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
  • webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
  • webauthncose: validate okp key algorithm (#759) (98c528b)
  • webauthn: deprecations and handle check (#745) (8619bb9)
  • webauthn: include backup flag check in registration (#748) (26a4868)
  • webauthn: only update uv flag (#746) (b39c822)
  • webauthn: use session relying party id (#747) (ebb45e2)

Features

  • metadata: update to r46 anchor (#780) (20f33e6)
  • ml-dsa preference list and gated availability (#768) (db1e068)
  • protocol: client capability enumeration (#765) (62f4489)
  • protocol: compound sub-statement scope (#742) (34271da)
  • protocol: current user details signal constructor (#766) (b6db923)
  • protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
  • protocol: related origins well-known document (#753) (05d54dc)
  • protocol: relying party attestation policy (#741) (3239ed0)

... (truncated)

Changelog

Sourced from github.com/go-webauthn/webauthn's changelog.

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int [MIGRATION.md] as they are substantial between ths version and prior versions.

Bug Fixes

  • metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
  • metadata: consistent revocation policy and client timeouts (#740) (34d324b)
  • metadata: handle certificate chains of any depth (#737) (309ea69)
  • metadata: honour status report order and effective dates (#736) (8be5355)
  • metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
  • metadata: prevent panic corrupt blob (#698) (c5fd013)
  • metadata: report malformed status report urls (#738) (ed82f7c)
  • protocol: allow any attestation eku (#728) (f4e33fc)
  • protocol: androidkey missing authorization list member (#727) (9b02b19)
  • protocol: androidkey union generated (#729) (3ed3e75)
  • protocol: bind credential public key curve to its algorithm (#752) (314c2be)
  • protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
  • protocol: compound returns incorrect type (#731) (025d897)
  • protocol: credential public key match limited to ECDSA (#732) (b4df26e)
  • protocol: harden credential response and options handling (#763) (de0ae6c)
  • protocol: missing tpm steps (#725) (f9a63f9)
  • protocol: opaque origin matching and validation (#758) (37f065a)
  • protocol: possible panic conditions (#719) (0ea14e7)
  • protocol: safetynet validation steps (#726) (e12f6e8)
  • protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
  • webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
  • webauthncose: validate okp key algorithm (#759) (98c528b)
  • webauthn: deprecations and handle check (#745) (8619bb9)
  • webauthn: include backup flag check in registration (#748) (26a4868)
  • webauthn: only update uv flag (#746) (b39c822)
  • webauthn: use session relying party id (#747) (ebb45e2)

Features

  • metadata: update to r46 anchor (#780) (20f33e6)
  • ml-dsa preference list and gated availability (#768) (db1e068)
  • protocol: client capability enumeration (#765) (62f4489)
  • protocol: compound sub-statement scope (#742) (34271da)
  • protocol: current user details signal constructor (#766) (b6db923)
  • protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
  • protocol: related origins well-known document (#753) (05d54dc)
  • protocol: relying party attestation policy (#741) (3239ed0)
  • typed extension inputs and outputs (#734) (0661c81)

... (truncated)

Commits

Updates github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/minio/minio-go/v7 from 7.0.76 to 7.3.0

Release notes

Sourced from github.com/minio/minio-go/v7's releases.

v7.3.0

What's Changed

New Contributors

Full Changelog: minio/minio-go@v7.2.1...v7.3.0

v7.2.0

What's Changed

Full Changelog: minio/minio-go@v7.1.0...v7.2.0

Release v7.1.0

What's Changed

... (truncated)

Commits
  • ce0e323 update lib version to v7.3.0
  • 2f55211 rdma: build against libs3rdma, and fix the size guard's off-by-one (#2283)
  • 1e3d492 feat: propagate caller context through credential providers (#2275)
  • e7b0801 Add AIStor Lifecycle Compression (#2281)
  • b15d168 build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#2280)
  • d1e1ecd fix: return delete-marker ObjectInfo from StatObject alongside the error (#2273)
  • f230068 fix: declare aws-chunked content encoding on streaming uploads (#2277)
  • 90530cf Add end-to-end checksum verification on GetObject (#2272)

@dependabot
build(deps): bump the go-minor-patch group across 1 directory with 13…
cb45a1f 
… updates

Bumps the go-minor-patch group with 11 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/fatih/color](https://github.com/fatih/color) | `1.18.0` | `1.19.0` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.1.0` | `5.3.2` |
| [github.com/go-chi/cors](https://github.com/go-chi/cors) | `1.2.1` | `1.2.2` |
| [github.com/go-chi/httprate](https://github.com/go-chi/httprate) | `0.14.1` | `0.16.0` |
| [github.com/go-webauthn/webauthn](https://github.com/go-webauthn/webauthn) | `0.17.4` | `0.18.0` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.2` | `5.10.0` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.0.76` | `7.3.0` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.34.0` | `1.35.1` |
| [github.com/spf13/viper](https://github.com/spf13/viper) | `1.19.0` | `1.21.0` |
| [github.com/tus/tusd/v2](https://github.com/tus/tusd) | `2.9.2` | `2.10.0` |
| [golang.org/x/image](https://github.com/golang/image) | `0.43.0` | `0.45.0` |



Updates `github.com/fatih/color` from 1.18.0 to 1.19.0
- [Release notes](https://github.com/fatih/color/releases)
- [Commits](fatih/color@v1.18.0...v1.19.0)

Updates `github.com/go-chi/chi/v5` from 5.1.0 to 5.3.2
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.1.0...v5.3.2)

Updates `github.com/go-chi/cors` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/go-chi/cors/releases)
- [Commits](go-chi/cors@v1.2.1...v1.2.2)

Updates `github.com/go-chi/httprate` from 0.14.1 to 0.16.0
- [Release notes](https://github.com/go-chi/httprate/releases)
- [Commits](go-chi/httprate@v0.14.1...v0.16.0)

Updates `github.com/go-webauthn/webauthn` from 0.17.4 to 0.18.0
- [Release notes](https://github.com/go-webauthn/webauthn/releases)
- [Changelog](https://github.com/go-webauthn/webauthn/blob/master/CHANGELOG.md)
- [Commits](go-webauthn/webauthn@v0.17.4...v0.18.0)

Updates `github.com/jackc/pgx/v5` from 5.9.2 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.2...v5.10.0)

Updates `github.com/minio/minio-go/v7` from 7.0.76 to 7.3.0
- [Release notes](https://github.com/minio/minio-go/releases)
- [Commits](minio/minio-go@v7.0.76...v7.3.0)

Updates `github.com/rs/zerolog` from 1.34.0 to 1.35.1
- [Commits](rs/zerolog@v1.34.0...v1.35.1)

Updates `github.com/spf13/cobra` from 1.8.1 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.8.1...v1.10.2)

Updates `github.com/spf13/viper` from 1.19.0 to 1.21.0
- [Release notes](https://github.com/spf13/viper/releases)
- [Commits](spf13/viper@v1.19.0...v1.21.0)

Updates `github.com/tus/tusd/v2` from 2.9.2 to 2.10.0
- [Release notes](https://github.com/tus/tusd/releases)
- [Commits](tus/tusd@v2.9.2...v2.10.0)

Updates `golang.org/x/crypto` from 0.52.0 to 0.55.0
- [Commits](golang/crypto@v0.52.0...v0.55.0)

Updates `golang.org/x/image` from 0.43.0 to 0.45.0
- [Commits](golang/image@v0.43.0...v0.45.0)

---
updated-dependencies:
- dependency-name: github.com/fatih/color
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/go-chi/cors
  dependency-version: 1.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/go-chi/httprate
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/go-webauthn/webauthn
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/minio/minio-go/v7
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/rs/zerolog
  dependency-version: 1.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/spf13/viper
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/tus/tusd/v2
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: golang.org/x/image
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added the dependencies Dependency updates label Aug 31, 2026
@dependabot
dependabot Bot requested a review from Sulaiman-Dauda as a code owner August 31, 2026 08:56
@dependabot dependabot Bot added the dependencies Dependency updates label Aug 31, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 21, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/backend/go-minor-patch-04f56169d4 branch September 21, 2026 08:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Sulaiman-Dauda Sulaiman-Dauda Awaiting requested review from Sulaiman-Dauda Sulaiman-Dauda is a code owner

Assignees

No one assigned

Labels

dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants