chore(deps): bump the go-deps group across 1 directory with 7 updates

[dependabot]

Bumps the go-deps group with 7 updates in the / directory:

Package	From	To
golang.org/x/crypto	0.49.0	0.54.0
github.com/ThalesGroup/crypto11	1.2.6	1.6.2
github.com/beevik/etree	1.6.0	1.7.0
github.com/miekg/dns	1.1.70	1.1.72
github.com/sirosfoundation/go-cryptoutil	0.2.0	0.6.0
github.com/sirosfoundation/go-trust	0.0.0-20260108214437-2745da0592da	0.9.0
go.mongodb.org/mongo-driver	1.17.6	1.17.9

Updates golang.org/x/crypto from 0.49.0 to 0.54.0

Commits

• cdce021 go.mod: update golang.org/x dependencies
• d9474cc openpgp: make the deprecation message more explicit
• 7626c50 ssh: verify declared key type matches decoded key in authorized_keys
• 0471e79 ssh/agent: enforce strict limits on DSA key parameters
• 6435c37 ssh: sanitize client disconnect messages
• 7d695da ssh/agent: drain channel stderr in agent forwarders
• 5b7f841 acme/autocert: fix data race in Manager.createCert
• 0b316e7 argon2: update RFC 9106 parameter recommendations
• 55aec0a x509roots/fallback: update bundle
• 5f2de1a internal: remove wycheproof tests
• Additional commits viewable in compare view

Updates github.com/ThalesGroup/crypto11 from 1.2.6 to 1.6.2

Release notes

Sourced from github.com/ThalesGroup/crypto11's releases.

v1.6.2

• downgrade the go version to 1.25.0 as per thales-transfer/crypto11#137

• add go toolchain

Full Changelog: eclipse-keypont/crypto11@v1.6.0...v1.6.2

v1.6.0

What's Changed

• Update go1.25.1 by @​Nicolas-Peiffer in ThalesGroup/crypto11#124

Full Changelog: eclipse-keypont/crypto11@v1.5.0...v1.6.0

v1.5.0

What's Changed

• Fix findkeys error and eval byte nil or len zero by @​Nicolas-Peiffer in ThalesGroup/crypto11#122
• Update go1.24.5 by @​Nicolas-Peiffer in ThalesGroup/crypto11#123

Full Changelog: eclipse-keypont/crypto11@v1.4.1...v1.5.0

v1.4.2-rc

• update to go1.23.9

Full Changelog: eclipse-keypont/crypto11@v1.4.0...v1.4.2-rc

v1.4.1

What's Changed

• update to go 1.23.6
• fix: underlying library context is reused through reference counting by @​ek-1n574 in ThalesGroup/crypto11#114

New Contributors

• @​ek-1n574 made their first contribution in ThalesGroup/crypto11#114

Full Changelog: eclipse-keypont/crypto11@v1.4.0...v1.4.1

v1.4.0

What's Changed

• upgrade to go1.23.6 by @​Nicolas-Peiffer in ThalesGroup/crypto11#116

New Contributors

• @​Nicolas-Peiffer made their first contribution in ThalesGroup/crypto11#116

Full Changelog: eclipse-keypont/crypto11@v1.3.0...v1.4.0

v1.3.0

What's Changed

• feature: optimized aes cbc support by @​IceManGreen in ThalesGroup/crypto11#107

... (truncated)

Commits

• See full diff in compare view

Updates github.com/beevik/etree from 1.6.0 to 1.7.0

Release notes

Sourced from github.com/beevik/etree's releases.

Release 1.7.0

Breaking changes

• To address a security issue, it was necessary to add a MaxDepth option to ReadSettings to limit the depth of XML trees during parsing. A generous default value of 1024 was chosen to avoid breaking most existing code. However, if your code is processing XML hierarchies with a depth greater than 1024, you will need to assign your Document a ReadSettings that has a MaxDepth set to a higher value.

Security Fixes

• Limited the depth of XML trees processed by all ReadFrom functions during parsing.
• Fixed a CompilePath index-out-of-range panic that could be caused by a missing path filter key.
• Sanitized the contents of XML text, comment, ProcInst and Directive tokens provided by the user.

Changelog

Sourced from github.com/beevik/etree's changelog.

Release 1.7.0

Changes

Breaking changes

• To address a security issue, it was necessary to add a MaxDepth option to ReadSettings to limit the depth of XML trees during parsing. A generous default value of 1024 was chosen to avoid breaking most existing code. However, if your code is processing XML hierarchies with a depth greater than 1024, you will need to assign your Document a ReadSettings that has a MaxDepth set to a higher value.

Security Fixes

• Limited the depth of XML trees processed by all ReadFrom functions during parsing.
• Fixed a CompilePath index-out-of-range panic that could be caused by a missing path filter key.
• Sanitized the contents of XML text, comment, ProcInst and Directive tokens provided by the user.

Commits

• 51e79d6 Release v1.7.0
• 236bb93 Document duplication bug fix
• 1215e0a Enforce maximum XML tree depth during parsing
• 936bc58 Sanitize XML contents provided by callers
• 62d8a79 Fix CompilePath index-out-of-range panic
• See full diff in compare view

Updates github.com/miekg/dns from 1.1.70 to 1.1.72

Commits

• cb21f4d Release 1.1.72
• 507a0f9 Release
• c376872 Make PackDomainName return error if the root label doesn't fit (#1702)
• 604b539 fix Client xxxTimeout policy (#1700)
• See full diff in compare view

Updates github.com/sirosfoundation/go-cryptoutil from 0.2.0 to 0.6.0

Release notes

Sourced from github.com/sirosfoundation/go-cryptoutil's releases.

v0.6.0 — pkcs11pool stability fixes

Changes

Bug fixes

• Pool slot leak on recovery failure (): When RecoverSession fails, the broken session is now returned to the pool via Release() instead of being closed directly via ctx.CloseSession(). This preserves the pool channel capacity — the next caller will trigger a new recovery attempt and replace the broken session properly.

• CKA_ID double-encoding in ListECKeys (): GenerateECKey stores CKA_ID as the ASCII bytes of the hex kid string. ListECKeys was re-encoding those bytes with hex.EncodeToString, producing a hex-of-hex value. Fixed to use string(attrs[0].Value) for correct round-tripping.

• General pkcs11pool robustness (PR #19): Acquire/Release/Close guards, login tolerance, session recovery ordering, token label trimming.

Tests

• SoftHSM2 integration tests covering pool lifecycle, key generation, signing, ECDH, listing, recovery, and error paths (71.5% statement coverage).

v0.5.0

No release notes provided.

Commits

• c762f0c fix(pkcs11pool): address remaining Copilot review findings
• c186cd7 fix(pkcs11pool): address Copilot code review findings (#19)
• c328080 feat: add pkcs11pool shared PKCS#11 session pool library (#18)
• c6b0d98 fix: standardize LICENSE to BSD-2-Clause attributed to SIROS Foundation (#17)
• 3eb88fb fix: replace write-all with scoped workflow permissions (#15)
• 9a4ca84 fix: replace read-all with specific permissions in scorecard workflow (#14)
• e5cd310 ci: add SonarCloud and OpenSSF Scorecard workflows (#12)
• 473ab79 chore(deps): bump the go-deps group in /brainpool with 2 updates (#6)
• d238a57 chore(deps): bump the github-actions group with 4 updates (#7)
• 95ee00e ci: use go-version-file instead of hardcoded version (#8)
• Additional commits viewable in compare view

Updates github.com/sirosfoundation/go-trust from 0.0.0-20260108214437-2745da0592da to 0.9.0

Release notes

Sourced from github.com/sirosfoundation/go-trust's releases.

v0.8.0

What's new

Pub-EAA profile-aware service status checking (ETSI TS 119 602 Annex H)

The LoTE registry now enforces Pub-EAA-specific trust semantics when evaluating entities from a EUPubEAAProvidersList LoTE:

• Service-level notified-status gate: an entity is only trusted if at least one of its services has ServiceStatus = notified. Entities with all services absent or withdrawn are rejected with a specific reason message.
• Notified-only key indexing: buildIndex now only indexes digital identities (JWK and X.509) from notified services in Pub-EAA LoTEs. Keys from non-notified (absent or other status) services are excluded at index time, preventing a key from an untrusted service being accepted via an entity that happens to have a separate notified service.
• CA-anchored path enforcement: the CA-anchored x5c fallback (validateX5CChainCA) now also enforces Pub-EAA service status. A chain anchoring to a Pub-EAA CA whose services are not notified is rejected.
• Informative deny reasons: the deny reason distinguishes between "all services withdrawn" and "no notified service" to aid debugging.
• CI: SonarCloud workflow skips gracefully for fork pull requests.

Non-Pub-EAA LoTEs

No behaviour change — presence in the list remains the trust signal for all other profile types (PID, WRPAC, WRPRC, Wallet Registrars, etc.).

v0.7.0

What's new

feat: RP certificate validation and WRPRC abstraction layer (#70)

• pkg/registry/rpcert — new package:
  • WRPACProfile — ETSI TS 119 411-8 Wallet-Relying Party Access Certificate profile
  • JWTRegistrationCertValidator — validates JWT Registration Certificates (WRPRC, rc-wrp+jwt)
  • RPEntitlements, WRPRCSubject — RP entitlement role URIs (all Annex A.2 roles)
  • DCQL entitlement credential query language support
  • ProfileRegistry and DefaultProfileRegistry
  • StubRegisterClient placeholder for TS5/TS6 National Register API
• pkg/registry/x5c_enrichment — shared post-chain-validation helper (profile matching, identity extraction, DCQL/entitlement checks) used by all registry backends
• lote: CA-anchored trust fallback — subjects not published in a LoTE are now accepted when their x5c chain validates against a listed CA entity (fixes #90)
• etsi / lote / static / mdociaca: accept any EKU when verifying x5c chains — resolves WRPAC client-auth-only EKU rejection (fixes #81)
• Closes #65, #66, #67, #81, #90

Other changes since v0.6.1

• feat: support GT_CONFIG environment variable for config file path (#99)
• fix: env var overrides now applied even when no config file is present (#97)
• fix: server start log message shows correct host and port (#93)
• docs: update whitelist example config to use lists/actions format (#92)
• chore: bump golang.org/x/net, alpine, and GitHub Actions versions

v0.6.1

No release notes provided.

v0.6.0

No release notes provided.

v0.5.0

No release notes provided.

... (truncated)

Commits

• See full diff in compare view

Updates go.mongodb.org/mongo-driver from 1.17.6 to 1.17.9

Release notes

Sourced from go.mongodb.org/mongo-driver's releases.

MongoDB Go Driver 1.17.9

The MongoDB Go Driver Team is pleased to release version 1.17.9 of the official MongoDB Go Driver.

Release Highlights

This release fixes a bug caused by variable shadowing.

What's Changed

🐛 Fixed

• GODRIVER-3793 Fix variable shadowing in rtt monitor by @​prestonvasquez in mongodb/mongo-go-driver#2317

Full Changelog: mongodb/mongo-go-driver@v1.17.8...v1.17.9

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. Questions and inquiries can be asked on the MongoDB Developer Community. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 1.17.8

The MongoDB Go Driver Team is pleased to release version 1.17.8 of the official MongoDB Go Driver.

Release Highlights

This release adds a deprecation notice to go.mongodb.org/mongo-driver, indicating users should migrate to go.mongodb.org/mongo-driver/v2. See the V2 migration guide for more information.

What's Changed

✨ New Features

• GODRIVER-3773 Deprecate v1 by @​prestonvasquez in mongodb/mongo-go-driver#2312

Full Changelog: mongodb/mongo-go-driver@v1.17.7...v1.17.8

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. Questions and inquiries can be asked on the MongoDB Developer Community. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 1.17.7

The MongoDB Go Driver Team is pleased to release version 1.17.7 of the official MongoDB Go Driver.

Release Highlights

This release removes the deprecation notice from options.MergeClientOptions and fixes buffer handling in GSSAPI error description and username functions.

What's Changed

... (truncated)

Commits

• 3b10ae6 BUMP v1.17.9
• f490802 GODRIVER-3793 Fix variable shadowing in rtt monitor (#2317)
• 5ac5a1e BUMP v1.17.8
• f378649 Revert dry-run release bump
• 08c2b98 BUMP v1.17.8
• fafe527 GODRIVER-3773 Deprecate v1 (#2312)
• eb01e7e BUMP v1.17.7
• 3c55093 GODRIVER-3766 Remove deprecation notice for MergeClientOptions (#2294)
• f6163bf GODRIVER-3770 Remove libasan from gssapi tests in CI (#2293)
• 6798963 GODRIVER-3770 Fix buffer handling in GSSAPI error description and username fu...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.